diff --git a/index.html b/index.html
index 3ac523f..da9c1b2 100644
--- a/index.html
+++ b/index.html
@@ -1222,9 +1222,9 @@
 	}
 </style>
   <link href="https://www.w3.org/StyleSheets/TR/2016/cg-draft" rel="stylesheet">
-  <meta content="Bikeshed version a33f8714, updated Thu Apr 23 16:21:43 2020 -0700" name="generator">
+  <meta content="Bikeshed version 4be3a54e, updated Mon May 4 06:47:10 2020 -0700" name="generator">
   <link href="https://privacycg.github.io/storage-access/" rel="canonical">
-  <meta content="2380106834bb2455ebf8d02c94166505e36a34f9" name="document-revision">
+  <meta content="bd884727938a1faa9303b469508365311f9957e5" name="document-revision">
 <style>
 .XXX {
     color: #E50000;
@@ -1480,7 +1480,7 @@
   <header>
    <p data-fill-with="logo"></p>
    <h1 class="no-ref" id="title">The Storage Access API</h1>
-   <h2 class="no-num no-toc no-ref heading settled" id="subtitle"><span class="content">Draft Community Group Report, <time datetime="2020-04-24">24 April 2020</time></span></h2>
+   <h2 class="no-num no-toc no-ref heading settled" id="subtitle"><span class="content">Draft Community Group Report, <time datetime="2020-05-08">8 May 2020</time></span></h2>
    <div data-fill-with="spec-metadata">
     <dl>
      <dt>This version:
@@ -1565,54 +1565,73 @@ <h2 class="heading settled" data-level="1" id="intro"><span class="secno">1. </s
    <h2 class="heading settled" data-level="2" id="infra"><span class="secno">2. </span><span class="content">Infrastructure</span><a class="self-link" href="#infra"></a></h2>
    <p>This specification depends on the Infra standard. <a data-link-type="biblio" href="#biblio-infra">[INFRA]</a></p>
    <h2 class="heading settled" data-level="3" id="the-storage-access-api"><span class="secno">3. </span><span class="content">The Storage Access API</span><a class="self-link" href="#the-storage-access-api"></a></h2>
-   <p>A <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document">Document</a></code> is said to be <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="first-party">first party</dfn> when the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin">origin</a> and <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#top-level-origin" id="ref-for-top-level-origin">top-level origin</a> of its <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object" id="ref-for-relevant-settings-object">relevant settings object</a> are <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#same-site" id="ref-for-same-site">same site</a> with one another. Otherwise, it is said to be <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="third-party">third party</dfn>.</p>
-   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="first-party-data">first party data</dfn> of a <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document①">Document</a></code> is the client-side storage it would normally have access to if it were <a data-link-type="dfn" href="#first-party" id="ref-for-first-party">first party</a>.</p>
-   <p>This specification defines a method to query whether or not a <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document②">Document</a></code> currently has access to its <a data-link-type="dfn" href="#first-party-data" id="ref-for-first-party-data">first party data</a> (<code class="idl"><a data-link-type="idl" href="#dom-document-hasstorageaccess" id="ref-for-dom-document-hasstorageaccess">hasStorageAccess()</a></code>), and a method that can be used to request access to a <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document③">Document</a></code>'s <a data-link-type="dfn" href="#first-party-data" id="ref-for-first-party-data①">first party data</a> (<code class="idl"><a data-link-type="idl" href="#dom-document-requeststorageaccess" id="ref-for-dom-document-requeststorageaccess">requestStorageAccess()</a></code>).</p>
-   <div class="example" id="example-72acdc93">
-    <a class="self-link" href="#example-72acdc93"></a> 
-    <p>Alex visits <code>https://social.example/</code>. The page sets a cookie. This cookie has been set in a first party context.</p>
-    <p>Later on, Alex visits <code>https://video.example/</code>, which has an <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element②">iframe</a></code> on it which loads <code>https://social.example/heart-button-widget</code>. In this case, the <code>social.example</code> <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document④">Document</a></code> <var>doc</var> is <a data-link-type="dfn" href="#third-party" id="ref-for-third-party">third party</a>, and the cookie set previously might or might not be visible from <var>doc</var><code>.</code><code class="idl"><a data-link-type="idl" href="https://html.spec.whatwg.org/multipage/dom.html#dom-document-cookie" id="ref-for-dom-document-cookie">cookie</a></code>, depending on User Agent storage access policies.</p>
+   <p>This specification defines a method to query whether or not a <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document">Document</a></code> currently has access to its <a data-link-type="dfn" href="#first-party-data" id="ref-for-first-party-data">first party data</a> (<code class="idl"><a data-link-type="idl" href="#dom-document-hasstorageaccess" id="ref-for-dom-document-hasstorageaccess">hasStorageAccess()</a></code>), and a method that can be used to request access to its <a data-link-type="dfn" href="#first-party-data" id="ref-for-first-party-data①">first party data</a> (<code class="idl"><a data-link-type="idl" href="#dom-document-requeststorageaccess" id="ref-for-dom-document-requeststorageaccess">requestStorageAccess()</a></code>).</p>
+   <div class="example" id="example-a7805ce9">
+    <a class="self-link" href="#example-a7805ce9"></a> 
+    <p>Alex visits <code>https://social.example/</code>. The page sets a cookie. This cookie has been set in a <a data-link-type="dfn" href="#first-party-site-context" id="ref-for-first-party-site-context">first-party-site context</a>.</p>
+    <p>Later on, Alex visits <code>https://video.example/</code>, which has an <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element②">iframe</a></code> on it which loads <code>https://social.example/heart-button</code>. In this case, the <code>social.example</code> <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document①">Document</a></code> <var>doc</var> is in a <a data-link-type="dfn" href="#third-party-context" id="ref-for-third-party-context">third party context</a>, and the cookie set previously might or might not be visible from <var>doc</var><code>.</code><code class="idl"><a data-link-type="idl" href="https://html.spec.whatwg.org/multipage/dom.html#dom-document-cookie" id="ref-for-dom-document-cookie">cookie</a></code>, depending on User Agent storage access policies.</p>
     <p>Script in the <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element③">iframe</a></code> can call <var>doc</var><code>.</code><code class="idl"><a data-link-type="idl" href="#dom-document-hasstorageaccess" id="ref-for-dom-document-hasstorageaccess①">hasStorageAccess()</a></code> to determine if it has access to the cookie. If it does not have access, it can request access by calling <var>doc</var><code>.</code><code class="idl"><a data-link-type="idl" href="#dom-document-requeststorageaccess" id="ref-for-dom-document-requeststorageaccess①">requestStorageAccess()</a></code>.</p>
    </div>
+   <p><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="first-party-data">First party data</dfn> is client-side storage that would be available to a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#site" id="ref-for-site">site</a> were it loaded in a <a data-link-type="dfn" href="#first-party-site-context" id="ref-for-first-party-site-context①">first-party-site context</a>.</p>
+   <p>A <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document②">Document</a></code> is in a <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="first-party-site-context">first-party-site context</dfn> if it is the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#active-document" id="ref-for-active-document">active document</a> of a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#top-level-browsing-context" id="ref-for-top-level-browsing-context">top-level browsing context</a>. Otherwise, it is in a <a data-link-type="dfn" href="#first-party-site-context" id="ref-for-first-party-site-context②">first-party-site context</a> if it is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#active-document" id="ref-for-active-document①">active document</a> and the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin">origin</a> and <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#top-level-origin" id="ref-for-top-level-origin">top-level origin</a> of its <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object" id="ref-for-relevant-settings-object">relevant settings object</a> are <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#same-site" id="ref-for-same-site">same site</a> with one another.</p>
+   <p>A <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document③">Document</a></code> is in a <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="third-party-context">third party context</dfn> if it is not in a <a data-link-type="dfn" href="#first-party-site-context" id="ref-for-first-party-site-context③">first-party-site context</a>.</p>
+   <p class="issue" id="issue-b7678c76"><a class="self-link" href="#issue-b7678c76"></a> If we let nested <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element④">iframe</a></code>s use this API, we may have to revisit these definitions. <a href="https://github.com/privacycg/storage-access/issues/10">&lt;https://github.com/privacycg/storage-access/issues/10></a></p>
    <h3 class="heading settled" data-level="3.1" id="ua-state"><span class="secno">3.1. </span><span class="content">User Agent state related to storage access</span><a class="self-link" href="#ua-state"></a></h3>
-   <p>Each User Agent maintains a <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="storage-access-map">storage access map</dfn>, an <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map">ordered map</a> whose keys are <a data-link-type="dfn" href="#partitioned-storage-key" id="ref-for-partitioned-storage-key">partitioned storage keys</a> and whose values are <a data-link-type="dfn" href="#storage-access-flag-set" id="ref-for-storage-access-flag-set">storage access flag sets</a>.</p>
-   <p class="issue" id="issue-308d22de"><a class="self-link" href="#issue-308d22de"></a> What’s the lifetime of the <a data-link-type="dfn" href="#storage-access-map" id="ref-for-storage-access-map">storage access map</a> and of its entries?</p>
-   <p class="issue" id="issue-e9bb7e96"><a class="self-link" href="#issue-e9bb7e96"></a> Tie the <a data-link-type="dfn" href="#storage-access-map" id="ref-for-storage-access-map①">storage access map</a> to agent clusters. <a href="https://github.com/privacycg/storage-access/issues/28">&lt;https://github.com/privacycg/storage-access/issues/28></a></p>
-   <p>A <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="partitioned-storage-key">partitioned storage key</dfn> is a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#pair" id="ref-for-pair">pair</a> consisting of a top-level site and a site, both <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#site" id="ref-for-site">sites</a>.</p>
-   <p class="issue" id="issue-bf438984"><a class="self-link" href="#issue-bf438984"></a> Replace this <a data-link-type="dfn" href="#partitioned-storage-key" id="ref-for-partitioned-storage-key①">partitioned storage key</a> concept with whatever Anne comes up with for <a data-link-type="biblio" href="#biblio-storage">[STORAGE]</a>.</p>
-   <p>A <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="storage-access-flag-set">storage access flag set</dfn> is a set of zero or more of the following flags, which are used to gate access to client-side storage for <var>site</var> when it’s a <a data-link-type="dfn" href="#third-party" id="ref-for-third-party①">third party</a> on <var>top-level site</var>:</p>
-   <dl>
-    <dt data-md>The <dfn class="dfn-paneled" data-dfn-for="storage access flag set" data-dfn-type="dfn" data-noexport id="has-storage-access-flag">has storage access flag</dfn>
-    <dd data-md>
-     <p>When set, this flag indicates <var>site</var> has access to its <a data-link-type="dfn" href="#first-party-data" id="ref-for-first-party-data②">first party data</a> when it’s a <a data-link-type="dfn" href="#third-party" id="ref-for-third-party②">third party</a> on <var>top-level site</var>.</p>
-    <dt data-md>The <dfn class="dfn-paneled" data-dfn-for="storage access flag set" data-dfn-type="dfn" data-noexport id="was-expressly-denied-storage-access-flag">was expressly denied storage access flag</dfn>
-    <dd data-md>
-     <p>When set, this flag indicates that the user expressly denied <var>site</var> access to its <a data-link-type="dfn" href="#first-party-data" id="ref-for-first-party-data③">first party data</a> when it’s a <a data-link-type="dfn" href="#third-party" id="ref-for-third-party③">third party</a> on <var>top-level site</var>.</p>
-   </dl>
-   <p>To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="obtain-the-storage-access-flag-set" type="abstract-op">obtain the storage access flag set</dfn> for a <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document⑤">Document</a></code> <var>doc</var>, run the following steps:</p>
+   <p>A <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="storage-access-map">storage access map</dfn> is a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map">map</a> whose keys are <a data-link-type="dfn" href="#partitioned-storage-key" id="ref-for-partitioned-storage-key">partitioned storage keys</a> and whose values are <a data-link-type="dfn" href="#storage-access-flag-set" id="ref-for-storage-access-flag-set">storage access flag sets</a>.</p>
+   <p>User Agents maintain a single <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="global-storage-access-map">global storage access map</dfn>.</p>
+   <p class="issue" id="issue-c97088f3"><a class="self-link" href="#issue-c97088f3"></a> What is the lifecycle of the <a data-link-type="dfn" href="#global-storage-access-map" id="ref-for-global-storage-access-map">global storage access map</a>? How long do we remember its contents? Firefox and Safari differ here. <a href="https://github.com/privacycg/storage-access/issues/2">&lt;https://github.com/privacycg/storage-access/issues/2></a></p>
+   <p class="issue" id="issue-5b7f617d"><a class="self-link" href="#issue-5b7f617d"></a> When do we age out entries in the <a data-link-type="dfn" href="#global-storage-access-map" id="ref-for-global-storage-access-map①">global storage access map</a>? See also <a href="https://github.com/privacycg/storage-access#scope-of-storage-access">Scope of Storage Access</a>. <a href="https://github.com/privacycg/storage-access/issues/5">&lt;https://github.com/privacycg/storage-access/issues/5></a></p>
+   <p>Each <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-agent-clusters" id="ref-for-sec-agent-clusters">agent cluster</a> has a <dfn class="dfn-paneled" data-dfn-for="agent cluster" data-dfn-type="dfn" data-noexport id="agent-cluster-storage-access-map">storage access map</dfn>.</p>
+   <p>When an <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-agent-clusters" id="ref-for-sec-agent-clusters①">agent cluster</a> is created, its <a data-link-type="dfn" href="#agent-cluster-storage-access-map" id="ref-for-agent-cluster-storage-access-map">storage access map</a> is initialized with a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-clone" id="ref-for-map-clone">clone</a> of the <a data-link-type="dfn" href="#global-storage-access-map" id="ref-for-global-storage-access-map②">global storage access map</a>.</p>
+   <p>To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="obtain-the-storage-access-map" type="abstract-op">obtain the storage access map</dfn> for a <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document④">Document</a></code> <var>doc</var>, run the following steps:</p>
+   <ol>
+    <li data-md>
+     <p>Return the <a data-link-type="dfn" href="#agent-cluster-storage-access-map" id="ref-for-agent-cluster-storage-access-map①">storage access map</a> of <var>doc</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-agent" id="ref-for-relevant-agent">relevant agent</a>'s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-agent-clusters" id="ref-for-sec-agent-clusters②">agent cluster</a>.</p>
+   </ol>
+   <p>A <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="partitioned-storage-key">partitioned storage key</dfn> is a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#tuple" id="ref-for-tuple">tuple</a> consisting of a <dfn class="dfn-paneled" data-dfn-for="partitioned storage key" data-dfn-type="dfn" data-noexport id="partitioned-storage-key-top-level-site">top-level site</dfn> and an <dfn class="dfn-paneled" data-dfn-for="partitioned storage key" data-dfn-type="dfn" data-noexport id="partitioned-storage-key-embedded-site">embedded site</dfn> (both <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#site" id="ref-for-site①">sites</a>).</p>
+   <div class="example" id="example-2fc6d38b">
+    <a class="self-link" href="#example-2fc6d38b"></a> 
+    <p><code>(("https", "news.example"), ("https", "social.example"))</code> is a <a data-link-type="dfn" href="#partitioned-storage-key" id="ref-for-partitioned-storage-key①">partitioned storage key</a> whose <a data-link-type="dfn" href="#partitioned-storage-key-top-level-site" id="ref-for-partitioned-storage-key-top-level-site">top-level site</a> is <code>("https", "news.example")</code> and whose <a data-link-type="dfn" href="#partitioned-storage-key-embedded-site" id="ref-for-partitioned-storage-key-embedded-site">embedded site</a> is <code>("https", "social.example")</code>.</p>
+   </div>
+   <p>To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="generate-a-partitioned-storage-key" type="abstract-op">generate a partitioned storage key</dfn> for a <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document⑤">Document</a></code> <var>doc</var>, run the following steps:</p>
    <ol>
     <li data-md>
      <p>Let <var>settings</var> be <var>doc</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object" id="ref-for-relevant-settings-object①">relevant settings object</a>.</p>
     <li data-md>
      <p>Let <var>site</var> be the result of <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#obtain-a-site" id="ref-for-obtain-a-site">obtaining a site</a> from <var>settings</var>’ <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin①">origin</a>.</p>
     <li data-md>
-     <p>Let <var>top-level site</var> be the result of <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#obtain-a-site" id="ref-for-obtain-a-site①">obtaining a site</a> from <var>settings</var>’ <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#top-level-origin" id="ref-for-top-level-origin①">top-level origin</a>.</p>
-    <li data-md>
-     <p>Let <var>key</var> be the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#pair" id="ref-for-pair①">pair</a> <var>top-level site</var>/<var>site</var>.</p>
+     <p>If <var>doc</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-document-bc" id="ref-for-concept-document-bc">browsing context</a> is a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#top-level-browsing-context" id="ref-for-top-level-browsing-context①">top-level browsing context</a>, return the <a data-link-type="dfn" href="#partitioned-storage-key" id="ref-for-partitioned-storage-key②">partitioned storage key</a> (<var>site</var>, <var>site</var>).</p>
     <li data-md>
-     <p>Let <var>flags</var> be null.</p>
+     <p>Let <var>top-level site</var> be the result of <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#obtain-a-site" id="ref-for-obtain-a-site①">obtaining a site</a> from <var>settings</var>’ <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#top-level-origin" id="ref-for-top-level-origin①">top-level origin</a>.</p>
     <li data-md>
-     <p>If <a data-link-type="dfn" href="#storage-access-map" id="ref-for-storage-access-map②">storage access map</a>[<var>key</var>] <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists">exists</a>, set <var>flags</var> to <a data-link-type="dfn" href="#storage-access-map" id="ref-for-storage-access-map③">storage access map</a>[<var>key</var>].</p>
+     <p>Return the <a data-link-type="dfn" href="#partitioned-storage-key" id="ref-for-partitioned-storage-key③">partitioned storage key</a> (<var>top-level site</var>, <var>site</var>).</p>
+   </ol>
+   <p>A <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="storage-access-flag-set">storage access flag set</dfn> is a set of zero or more of the following flags, which are used to gate access to client-side storage for <var>embedded site</var> when loaded in a <a data-link-type="dfn" href="#third-party-context" id="ref-for-third-party-context①">third party context</a> on <var>top-level site</var>:</p>
+   <dl>
+    <dt data-md>The <dfn class="dfn-paneled" data-dfn-for="storage access flag set" data-dfn-type="dfn" data-noexport id="has-storage-access-flag">has storage access flag</dfn>
+    <dd data-md>
+     <p>When set, this flag indicates <var>embedded site</var> has access to its <a data-link-type="dfn" href="#first-party-data" id="ref-for-first-party-data②">first party data</a> when it’s loaded in a <a data-link-type="dfn" href="#third-party-context" id="ref-for-third-party-context②">third party context</a> on <var>top-level site</var>.</p>
+    <dt data-md>The <dfn class="dfn-paneled" data-dfn-for="storage access flag set" data-dfn-type="dfn" data-noexport id="was-expressly-denied-storage-access-flag">was expressly denied storage access flag</dfn>
+    <dd data-md>
+     <p>When set, this flag indicates that the user expressly denied <var>embedded site</var> access to its <a data-link-type="dfn" href="#first-party-data" id="ref-for-first-party-data③">first party data</a> when it’s loaded in a <a data-link-type="dfn" href="#third-party-context" id="ref-for-third-party-context③">third party context</a> on <var>top-level site</var>.</p>
+   </dl>
+   <p>To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="obtain-a-storage-access-flag-set" type="abstract-op">obtain a storage access flag set</dfn> for a <a data-link-type="dfn" href="#partitioned-storage-key" id="ref-for-partitioned-storage-key④">partitioned storage key</a> <var>key</var> from a <a data-link-type="dfn" href="#storage-access-map" id="ref-for-storage-access-map">storage access map</a> <var>map</var>, run the following steps:</p>
+   <ol>
     <li data-md>
-     <p>If <var>flags</var> is null, run these steps:</p>
+     <p>If <var>map</var>[<var>key</var>] <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists">does not exist</a>, run these steps:</p>
      <ol>
       <li data-md>
-       <p>Set <var>flags</var> to be a new <a data-link-type="dfn" href="#storage-access-flag-set" id="ref-for-storage-access-flag-set①">storage access flag set</a>.</p>
+       <p>Let <var>flags</var> be a new <a data-link-type="dfn" href="#storage-access-flag-set" id="ref-for-storage-access-flag-set①">storage access flag set</a>.</p>
       <li data-md>
-       <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-set" id="ref-for-map-set">Set</a> <a data-link-type="dfn" href="#storage-access-map" id="ref-for-storage-access-map④">storage access map</a>[<var>key</var>] to <var>flags</var>.</p>
+       <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-set" id="ref-for-map-set">Set</a> <var>map</var>[<var>key</var>] to <var>flags</var>.</p>
      </ol>
     <li data-md>
-     <p>Return <var>flags</var>.</p>
+     <p>Return <var>map</var>[<var>key</var>].</p>
+   </ol>
+   <p>To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="save-the-storage-access-flag-set" type="abstract-op">save the storage access flag set</dfn> for a <a data-link-type="dfn" href="#partitioned-storage-key" id="ref-for-partitioned-storage-key⑤">partitioned storage key</a> <var>key</var> in a <a data-link-type="dfn" href="#storage-access-map" id="ref-for-storage-access-map①">storage access map</a> <var>map</var>, run the following steps:</p>
+   <ol>
+    <li data-md>
+     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-set" id="ref-for-map-set①">Set</a> <a data-link-type="dfn" href="#global-storage-access-map" id="ref-for-global-storage-access-map③">global storage access map</a>[<var>key</var>] to <var>map</var>[<var>key</var>].</p>
    </ol>
    <h3 class="heading settled" data-level="3.2" id="the-document-object"><span class="secno">3.2. </span><span class="content">Changes to <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document⑥">Document</a></code></span><a class="self-link" href="#the-document-object"></a></h3>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="https://dom.spec.whatwg.org/#document" id="ref-for-document⑦"><c- g>Document</c-></a> {
@@ -1625,19 +1644,27 @@ <h3 class="heading settled" data-level="3.2" id="the-document-object"><span clas
     <li data-md>
      <p>Let <var>p</var> be <a data-link-type="dfn" href="https://heycam.github.io/webidl/#a-new-promise" id="ref-for-a-new-promise">a new promise</a>.</p>
     <li data-md>
-     <p>Let <var>flag set</var> be the result of <a data-link-type="dfn" href="#obtain-the-storage-access-flag-set" id="ref-for-obtain-the-storage-access-flag-set">obtaining the storage access flag set</a> of <var>doc</var>.</p>
+     <p>Let <var>map</var> be the result of <a data-link-type="dfn" href="#obtain-the-storage-access-map" id="ref-for-obtain-the-storage-access-map">obtaining the storage access map</a> for <var>doc</var>.</p>
+    <li data-md>
+     <p>Let <var>key</var> be the result of <a data-link-type="dfn" href="#generate-a-partitioned-storage-key" id="ref-for-generate-a-partitioned-storage-key">generating a partitioned storage key</a> from <var>doc</var>.</p>
     <li data-md>
-     <p>If <var>flag set</var>’s <a data-link-type="dfn" href="#was-expressly-denied-storage-access-flag" id="ref-for-was-expressly-denied-storage-access-flag">was expressly denied storage access flag</a> is set, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#resolve" id="ref-for-resolve">resolve</a> <var>p</var> with false and return <var>p</var>.</p>
+     <p>If <var>key</var> is failure, then <a data-link-type="dfn" href="https://heycam.github.io/webidl/#resolve" id="ref-for-resolve">resolve</a> <var>p</var> with false and return <var>p</var>.</p>
     <li data-md>
-     <p>If <var>doc</var>’s <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#concept-document-origin" id="ref-for-concept-document-origin">origin</a> is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque" id="ref-for-concept-origin-opaque">opaque origin</a>, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#resolve" id="ref-for-resolve①">resolve</a> <var>p</var> with false and return <var>p</var>.</p>
+     <p>Let <var>flag set</var> be the result of <a data-link-type="dfn" href="#obtain-a-storage-access-flag-set" id="ref-for-obtain-a-storage-access-flag-set">obtaining the storage access flag set</a> with <var>key</var> from <var>map</var>.</p>
     <li data-md>
-     <p>If <var>doc</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-document-bc" id="ref-for-concept-document-bc">browsing context</a> is a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#top-level-browsing-context" id="ref-for-top-level-browsing-context">top-level browsing context</a>, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#resolve" id="ref-for-resolve②">resolve</a> <var>p</var> with true and return <var>p</var>.</p>
+     <p>If <var>flag set</var>’s <a data-link-type="dfn" href="#was-expressly-denied-storage-access-flag" id="ref-for-was-expressly-denied-storage-access-flag">was expressly denied storage access flag</a> is set, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#resolve" id="ref-for-resolve①">resolve</a> <var>p</var> with false and return <var>p</var>.</p>
     <li data-md>
-     <p>Let <var>topDoc</var> be the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#active-document" id="ref-for-active-document">active document</a> of <var>doc</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-document-bc" id="ref-for-concept-document-bc①">browsing context</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#top-level-browsing-context" id="ref-for-top-level-browsing-context①">top-level browsing context</a>.</p>
+     <p>If <var>doc</var>’s <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#concept-document-origin" id="ref-for-concept-document-origin">origin</a> is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque" id="ref-for-concept-origin-opaque">opaque origin</a>, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#resolve" id="ref-for-resolve②">resolve</a> <var>p</var> with false and return <var>p</var>.</p>
     <li data-md>
-     <p>If <var>doc</var> is <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#same-origin" id="ref-for-same-origin">same origin</a> with <var>topDoc</var>, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#resolve" id="ref-for-resolve③">resolve</a> <var>p</var> with true and return <var>p</var>.</p>
+     <p>If <var>doc</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-document-bc" id="ref-for-concept-document-bc①">browsing context</a> is a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#top-level-browsing-context" id="ref-for-top-level-browsing-context②">top-level browsing context</a>, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#resolve" id="ref-for-resolve③">resolve</a> <var>p</var> with true and return <var>p</var>.</p>
     <li data-md>
-     <p>Resolve <var>p</var> with the result of running <a data-link-type="dfn" href="#determine-if-a-document-has-storage-access" id="ref-for-determine-if-a-document-has-storage-access">determine if a document has storage access</a> with <var>doc</var> and <var>topDoc</var>.</p>
+     <p>Let <var>topDoc</var> be the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#active-document" id="ref-for-active-document②">active document</a> of <var>doc</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-document-bc" id="ref-for-concept-document-bc②">browsing context</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#top-level-browsing-context" id="ref-for-top-level-browsing-context③">top-level browsing context</a>.</p>
+    <li data-md>
+     <p>If <var>doc</var> is <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#same-origin" id="ref-for-same-origin">same origin</a> with <var>topDoc</var>, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#resolve" id="ref-for-resolve④">resolve</a> <var>p</var> with true and return <var>p</var>.</p>
+    <li data-md>
+     <p>Let <var>key</var> be the result of <a data-link-type="dfn" href="#generate-a-partitioned-storage-key" id="ref-for-generate-a-partitioned-storage-key①">generating a partitioned storage key</a> from <var>doc</var>.</p>
+    <li data-md>
+     <p><a data-link-type="dfn" href="https://heycam.github.io/webidl/#resolve" id="ref-for-resolve⑤">Resolve</a> <var>p</var> with the result of running <a data-link-type="dfn" href="#determine-if-a-site-has-storage-access" id="ref-for-determine-if-a-site-has-storage-access">determine if a site has storage access</a> with <var>key</var> and <var>doc</var>.</p>
     <li data-md>
      <p>Return <var>p</var>.</p>
    </ol>
@@ -1652,93 +1679,127 @@ <h3 class="heading settled" data-level="3.2" id="the-document-object"><span clas
      <p><a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/infrastructure.html#enqueue-the-following-steps" id="ref-for-enqueue-the-following-steps">Enqueue the following steps</a> to <var>storage access request queue</var>:</p>
      <ol>
       <li data-md>
-       <p>Let <var>flag set</var> be the result of <a data-link-type="dfn" href="#obtain-the-storage-access-flag-set" id="ref-for-obtain-the-storage-access-flag-set①">obtaining the storage access flag set</a> of <var>doc</var>.</p>
+       <p>Let <var>map</var> be the result of <a data-link-type="dfn" href="#obtain-the-storage-access-map" id="ref-for-obtain-the-storage-access-map①">obtaining the storage access map</a> for <var>doc</var>.</p>
+      <li data-md>
+       <p>Let <var>key</var> be the result of <a data-link-type="dfn" href="#generate-a-partitioned-storage-key" id="ref-for-generate-a-partitioned-storage-key②">generating a partitioned storage key</a> from <var>doc</var>.</p>
+      <li data-md>
+       <p>If <var>key</var> is failure, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#reject" id="ref-for-reject">reject</a> <var>p</var>.</p>
+      <li data-md>
+       <p>Let <var>flag set</var> be the result of <a data-link-type="dfn" href="#obtain-a-storage-access-flag-set" id="ref-for-obtain-a-storage-access-flag-set①">obtaining the storage access flag set</a> with <var>key</var> from <var>map</var>.</p>
+      <li data-md>
+       <p>If <var>flag set</var>’s <a data-link-type="dfn" href="#was-expressly-denied-storage-access-flag" id="ref-for-was-expressly-denied-storage-access-flag①">was expressly denied storage access flag</a> is set, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#reject" id="ref-for-reject①">reject</a> <var>p</var>.</p>
       <li data-md>
-       <p>If <var>flag set</var>’s <a data-link-type="dfn" href="#was-expressly-denied-storage-access-flag" id="ref-for-was-expressly-denied-storage-access-flag①">was expressly denied storage access flag</a> is set, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#reject" id="ref-for-reject">reject</a> <var>p</var>.</p>
+       <p>If <var>flag set</var>’s <a data-link-type="dfn" href="#has-storage-access-flag" id="ref-for-has-storage-access-flag">has storage access flag</a> is set, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#resolve" id="ref-for-resolve⑥">resolve</a> <var>p</var>.</p>
       <li data-md>
-       <p>If <var>flag set</var>’s <a data-link-type="dfn" href="#has-storage-access-flag" id="ref-for-has-storage-access-flag">has storage access flag</a> is set, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#resolve" id="ref-for-resolve④">resolve</a> <var>p</var>.</p>
+       <p>If <var>doc</var>’s <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#concept-document-origin" id="ref-for-concept-document-origin①">origin</a> is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque" id="ref-for-concept-origin-opaque①">opaque origin</a>, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#reject" id="ref-for-reject②">reject</a> <var>p</var>.</p>
       <li data-md>
-       <p>If <var>doc</var>’s <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#concept-document-origin" id="ref-for-concept-document-origin①">origin</a> is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque" id="ref-for-concept-origin-opaque①">opaque origin</a>, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#reject" id="ref-for-reject①">reject</a> <var>p</var>.</p>
+       <p>If <var>doc</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-document-bc" id="ref-for-concept-document-bc③">browsing context</a> is a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#top-level-browsing-context" id="ref-for-top-level-browsing-context④">top-level browsing context</a>, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#resolve" id="ref-for-resolve⑦">resolve</a> <var>p</var>.</p>
       <li data-md>
-       <p>If <var>doc</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-document-bc" id="ref-for-concept-document-bc②">browsing context</a> is a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#top-level-browsing-context" id="ref-for-top-level-browsing-context②">top-level browsing context</a>, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#resolve" id="ref-for-resolve⑤">resolve</a> <var>p</var>.</p>
+       <p>Let <var>topDoc</var> be the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#active-document" id="ref-for-active-document③">active document</a> of <var>doc</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-document-bc" id="ref-for-concept-document-bc④">browsing context</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#top-level-browsing-context" id="ref-for-top-level-browsing-context⑤">top-level browsing context</a>.</p>
       <li data-md>
-       <p>Let <var>topDoc</var> be the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#active-document" id="ref-for-active-document①">active document</a> of <var>doc</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-document-bc" id="ref-for-concept-document-bc③">browsing context</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#top-level-browsing-context" id="ref-for-top-level-browsing-context③">top-level browsing context</a>.</p>
+       <p>If <var>doc</var> is <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#same-origin" id="ref-for-same-origin①">same origin</a> with <var>topDoc</var>, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#resolve" id="ref-for-resolve⑧">resolve</a> <var>p</var>.</p>
       <li data-md>
-       <p>If <var>doc</var> is <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#same-origin" id="ref-for-same-origin①">same origin</a> with <var>topDoc</var>, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#resolve" id="ref-for-resolve⑥">resolve</a> <var>p</var>.</p>
+       <p>If <var>doc</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#active-sandboxing-flag-set" id="ref-for-active-sandboxing-flag-set">active sandboxing flag set</a> has its <a data-link-type="dfn" href="#sandbox-storage-access-by-user-activation-flag" id="ref-for-sandbox-storage-access-by-user-activation-flag">sandbox storage access by user activation flag</a> set, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#reject" id="ref-for-reject③">reject</a> <var>p</var>.</p>
       <li data-md>
-       <p>If <var>doc</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#active-sandboxing-flag-set" id="ref-for-active-sandboxing-flag-set">active sandboxing flag set</a> has its <a data-link-type="dfn" href="#sandbox-storage-access-by-user-activation-flag" id="ref-for-sandbox-storage-access-by-user-activation-flag">sandbox storage access by user activation flag</a> set, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#reject" id="ref-for-reject②">reject</a> <var>p</var>.</p>
+       <p>If <var>doc</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-document-bc" id="ref-for-concept-document-bc⑤">browsing context</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#opener-browsing-context" id="ref-for-opener-browsing-context">opener browsing context</a> is not its <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#top-level-browsing-context" id="ref-for-top-level-browsing-context⑥">top-level browsing context</a>, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#reject" id="ref-for-reject④">reject</a> <var>p</var>.</p>
       <li data-md>
-       <p>If <var>doc</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-document-bc" id="ref-for-concept-document-bc④">browsing context</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#opener-browsing-context" id="ref-for-opener-browsing-context">opener browsing context</a> is not its <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#top-level-browsing-context" id="ref-for-top-level-browsing-context④">top-level browsing context</a>, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#reject" id="ref-for-reject③">reject</a> <var>p</var>.</p>
+       <p>If this algorithm was invoked when <var>doc</var>’s <code class="idl"><a data-link-type="idl" href="https://html.spec.whatwg.org/multipage/window-object.html#window" id="ref-for-window">Window</a></code> object did not have <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/interaction.html#transient-activation" id="ref-for-transient-activation">transient activation</a>, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#reject" id="ref-for-reject⑤">reject</a> <var>p</var>.</p>
       <li data-md>
-       <p>If this algorithm was invoked when <var>doc</var>’s <code class="idl"><a data-link-type="idl" href="https://html.spec.whatwg.org/multipage/window-object.html#window" id="ref-for-window">Window</a></code> object did not have <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/interaction.html#transient-activation" id="ref-for-transient-activation">transient activation</a>, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#reject" id="ref-for-reject④">reject</a> <var>p</var>.</p>
+       <p><a data-link-type="dfn" href="#determine-the-storage-access-policy" id="ref-for-determine-the-storage-access-policy">Determine the storage access policy</a> with <var>key</var>, <var>doc</var>, and <var>p</var>.</p>
       <li data-md>
-       <p><a data-link-type="dfn" href="#determine-the-storage-access-policy" id="ref-for-determine-the-storage-access-policy">Determine the storage access policy</a> with <var>doc</var>, <var>topDoc</var>, and <var>p</var>.</p>
+       <p>Set <var>flag set</var>’s <a data-link-type="dfn" href="#has-storage-access-flag" id="ref-for-has-storage-access-flag①">has storage access flag</a>.</p>
       <li data-md>
-       <p>Set <var>flag set</var>’s <a data-link-type="dfn" href="#has-storage-access-flag" id="ref-for-has-storage-access-flag①">has storage access flag</a>, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#resolve" id="ref-for-resolve⑦">resolve</a> <var>p</var>.</p>
+       <p><a data-link-type="dfn" href="#save-the-storage-access-flag-set" id="ref-for-save-the-storage-access-flag-set">Save the storage access flag set</a> for <var>key</var> in <var>map</var>.</p>
+      <li data-md>
+       <p><a data-link-type="dfn" href="https://heycam.github.io/webidl/#resolve" id="ref-for-resolve⑨">Resolve</a> <var>p</var>.</p>
      </ol>
     <li data-md>
      <p>Return <var>p</var>.</p>
    </ol>
    <p class="issue" id="issue-18c86ea4"><a class="self-link" href="#issue-18c86ea4"></a> Shouldn’t step 3.7 be <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#same-site" id="ref-for-same-site②">same site</a>?</p>
-   <p class="issue" id="issue-41e7fe80"><a class="self-link" href="#issue-41e7fe80"></a> Remove step 3.9 if we determine that nested <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element④">iframe</a></code>s should be able to request storage access. <a href="https://github.com/privacycg/storage-access/issues/10">&lt;https://github.com/privacycg/storage-access/issues/10></a></p>
+   <p class="issue" id="issue-41e7fe80"><a class="self-link" href="#issue-41e7fe80"></a> Remove step 3.9 if we determine that nested <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element⑤">iframe</a></code>s should be able to request storage access. <a href="https://github.com/privacycg/storage-access/issues/10">&lt;https://github.com/privacycg/storage-access/issues/10></a></p>
    <h4 class="heading settled" data-level="3.2.1" id="ua-policy"><span class="secno">3.2.1. </span><span class="content">User Agent storage access policies</span><a class="self-link" href="#ua-policy"></a></h4>
-   <p>Different User Agents have different policies around whether or not <a data-link-type="dfn" href="#third-party" id="ref-for-third-party④">third parties</a> may access their <a data-link-type="dfn" href="#first-party-data" id="ref-for-first-party-data④">first party data</a>. User Agents check and/or modify these policies when client-side storage is accessed (see <a href="#storage">§ 3.4 Changes to various client-side storage mechanisms</a>) as well as when <code class="idl"><a data-link-type="idl" href="#dom-document-hasstorageaccess" id="ref-for-dom-document-hasstorageaccess③">hasStorageAccess()</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-document-requeststorageaccess" id="ref-for-dom-document-requeststorageaccess③">requestStorageAccess()</a></code> are called.</p>
-   <p>To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="determine-if-a-document-has-storage-access" type="abstract-op">determine if a document has storage access</dfn> with <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document①⓪">Documents</a></code> <var>doc</var> and <var>topDoc</var>, run these steps:</p>
+   <p>Different User Agents have different policies around whether or not <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#site" id="ref-for-site②">sites</a> may access their <a data-link-type="dfn" href="#first-party-data" id="ref-for-first-party-data④">first party data</a> when they’re in a <a data-link-type="dfn" href="#third-party-context" id="ref-for-third-party-context④">third party context</a>. User Agents check and/or modify these policies when client-side storage is accessed (see <a href="#storage">§ 3.4 Changes to various client-side storage mechanisms</a>) as well as when <code class="idl"><a data-link-type="idl" href="#dom-document-hasstorageaccess" id="ref-for-dom-document-hasstorageaccess③">hasStorageAccess()</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-document-requeststorageaccess" id="ref-for-dom-document-requeststorageaccess③">requestStorageAccess()</a></code> are called.</p>
+   <p>To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="determine-if-a-site-has-storage-access" type="abstract-op">determine if a site has storage access</dfn> with <a data-link-type="dfn" href="#partitioned-storage-key" id="ref-for-partitioned-storage-key⑥">partitioned storage key</a> <var>key</var> and <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document①⓪">Document</a></code> <var>doc</var>, run these steps:</p>
    <ol>
     <li data-md>
-     <p class="assertion">Assert: <var>topDoc</var> is the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#active-document" id="ref-for-active-document②">active document</a> of <var>doc</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-document-bc" id="ref-for-concept-document-bc⑤">browsing context</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#top-level-browsing-context" id="ref-for-top-level-browsing-context⑤">top-level browsing context</a>.</p>
+     <p>Let <var>map</var> be the result of <a data-link-type="dfn" href="#obtain-the-storage-access-map" id="ref-for-obtain-the-storage-access-map②">obtaining the storage access map</a> for <var>doc</var>.</p>
     <li data-md>
-     <p>Let <var>flag set</var> be the result of <a data-link-type="dfn" href="#obtain-the-storage-access-flag-set" id="ref-for-obtain-the-storage-access-flag-set②">obtaining the storage access flag set</a> of <var>doc</var>.</p>
+     <p>Let <var>flag set</var> be the result of <a data-link-type="dfn" href="#obtain-a-storage-access-flag-set" id="ref-for-obtain-a-storage-access-flag-set②">obtaining the storage access flag set</a> with <var>key</var> from <var>map</var>.</p>
     <li data-md>
      <p>If <var>flag set</var>’s <a data-link-type="dfn" href="#has-storage-access-flag" id="ref-for-has-storage-access-flag②">has storage access flag</a> is set, return true.</p>
     <li data-md>
-     <p>Let <var>has storage access</var> (a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#boolean" id="ref-for-boolean">boolean</a>) be the result of running a UA-defined set of steps to determine if <var>doc</var> (a <a data-link-type="dfn" href="#third-party" id="ref-for-third-party⑤">third party</a> in <var>topDoc</var>) has access to its <a data-link-type="dfn" href="#first-party-data" id="ref-for-first-party-data⑤">first party data</a>.</p>
+     <p>Let <var>has storage access</var> (a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#boolean" id="ref-for-boolean">boolean</a>) be the result of running an <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#implementation-defined" id="ref-for-implementation-defined">implementation-defined</a> set of steps to determine if <var>key</var>’s <a data-link-type="dfn" href="#partitioned-storage-key-embedded-site" id="ref-for-partitioned-storage-key-embedded-site①">embedded site</a> has access to its <a data-link-type="dfn" href="#first-party-data" id="ref-for-first-party-data⑤">first party data</a> on <var>key</var>’s <a data-link-type="dfn" href="#partitioned-storage-key-top-level-site" id="ref-for-partitioned-storage-key-top-level-site①">top-level site</a>.</p>
     <li data-md>
      <p>If <var>has storage access</var> is true, set <var>flag set</var>’s <a data-link-type="dfn" href="#has-storage-access-flag" id="ref-for-has-storage-access-flag③">has storage access flag</a>.</p>
+    <li data-md>
+     <p><a data-link-type="dfn" href="#save-the-storage-access-flag-set" id="ref-for-save-the-storage-access-flag-set①">Save the storage access flag set</a> for <var>key</var> in <var>map</var>.</p>
     <li data-md>
      <p>Return <var>has storage access</var>.</p>
    </ol>
-   <p>To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="determine-the-storage-access-policy" type="abstract-op">determine the storage access policy</dfn> for <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document①①">Documents</a></code> <var>doc</var> and <var>topDoc</var> with <code class="idl"><a data-link-type="idl" href="https://heycam.github.io/webidl/#idl-promise" id="ref-for-idl-promise">Promise</a></code> <var>p</var>, run these steps:</p>
+   <p>To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="determine-the-storage-access-policy" type="abstract-op">determine the storage access policy</dfn> for <a data-link-type="dfn" href="#partitioned-storage-key" id="ref-for-partitioned-storage-key⑦">partitioned storage key</a> <var>key</var> with <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document①①">Document</a></code> <var>doc</var> and <code class="idl"><a data-link-type="idl" href="https://heycam.github.io/webidl/#idl-promise" id="ref-for-idl-promise">Promise</a></code> <var>p</var>, run these steps:</p>
    <ol>
     <li data-md>
-     <p class="assertion">Assert: <var>topDoc</var> is the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#active-document" id="ref-for-active-document③">active document</a> of <var>doc</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-document-bc" id="ref-for-concept-document-bc⑥">browsing context</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#top-level-browsing-context" id="ref-for-top-level-browsing-context⑥">top-level browsing context</a>.</p>
+     <p>Let <var>map</var> be the result of <a data-link-type="dfn" href="#obtain-the-storage-access-map" id="ref-for-obtain-the-storage-access-map③">obtaining the storage access map</a> for <var>doc</var>.</p>
     <li data-md>
-     <p>Let <var>implicitly granted</var> and <var>implicitly denied</var> (each a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#boolean" id="ref-for-boolean①">boolean</a>) be the result of running a UA-defined set of steps to determine if <var>doc</var>’s request for storage access on <var>topDoc</var> should be granted or denied without prompting the user.</p>
+     <p>Let <var>flag set</var> be the result of <a data-link-type="dfn" href="#obtain-a-storage-access-flag-set" id="ref-for-obtain-a-storage-access-flag-set③">obtaining the storage access flag set</a> with <var>key</var> from <var>map</var>.</p>
     <li data-md>
-     <p>If <var>implicitly granted</var> is true, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#resolve" id="ref-for-resolve⑧">resolve</a> <var>p</var> and return.</p>
+     <p>Let <var>implicitly granted</var> and <var>implicitly denied</var> (each a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#boolean" id="ref-for-boolean①">boolean</a>) be the result of running an <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#implementation-defined" id="ref-for-implementation-defined①">implementation-defined</a> set of steps to determine if <var>key</var>’s <a data-link-type="dfn" href="#partitioned-storage-key-embedded-site" id="ref-for-partitioned-storage-key-embedded-site②">embedded site</a>'s request for storage access on <var>key</var>’s <a data-link-type="dfn" href="#partitioned-storage-key-top-level-site" id="ref-for-partitioned-storage-key-top-level-site②">top-level site</a> should be granted or denied without prompting the user.</p>
+     <p class="note" role="note"><span>Note:</span> These <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#implementation-defined" id="ref-for-implementation-defined②">implementation-defined</a> set of steps might result in <var>flag set</var>’s <a data-link-type="dfn" href="#has-storage-access-flag" id="ref-for-has-storage-access-flag④">has storage access flag</a> and <a data-link-type="dfn" href="#was-expressly-denied-storage-access-flag" id="ref-for-was-expressly-denied-storage-access-flag②">was expressly denied storage access flag</a> changing, since the User Agent could have relevant out-of-band information (e.g. a user preference that changed) that this specification is unaware of.</p>
     <li data-md>
-     <p>If <var>implicitly denied</var> is true, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#reject" id="ref-for-reject⑤">reject</a> <var>p</var> and return.</p>
+     <p>If <var>implicitly granted</var> is true, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#resolve" id="ref-for-resolve①⓪">resolve</a> <var>p</var> and return.</p>
     <li data-md>
-     <p>Ask the user if they would like to grant <var>doc</var> access to its <a data-link-type="dfn" href="#first-party-data" id="ref-for-first-party-data⑥">first party data</a> when it is a <a data-link-type="dfn" href="#third-party" id="ref-for-third-party⑥">third party</a> on <var>topDoc</var>, and wait for an answer. Let <var>expressly granted</var> and <var>expressly denied</var> (both <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#boolean" id="ref-for-boolean②">booleans</a>) be the result.</p>
+     <p>If <var>implicitly denied</var> is true, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#reject" id="ref-for-reject⑥">reject</a> <var>p</var> and return.</p>
     <li data-md>
-     <p>If <var>expressly granted</var> is true, <a data-link-type="dfn" href="https://heycam.github.io/webidl/#resolve" id="ref-for-resolve⑨">resolve</a> <var>p</var> and return.</p>
+     <p>Ask the user if they would like to grant <var>key</var>’s <a data-link-type="dfn" href="#partitioned-storage-key-embedded-site" id="ref-for-partitioned-storage-key-embedded-site③">embedded site</a> access to its <a data-link-type="dfn" href="#first-party-data" id="ref-for-first-party-data⑥">first party data</a> when it’s loaded in a <a data-link-type="dfn" href="#third-party-context" id="ref-for-third-party-context⑤">third party context</a> on <var>key</var>’s <a data-link-type="dfn" href="#partitioned-storage-key-top-level-site" id="ref-for-partitioned-storage-key-top-level-site③">top-level site</a>, and wait for an answer. Let <var>expressly granted</var> and <var>expressly denied</var> (both <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#boolean" id="ref-for-boolean②">booleans</a>) be the result.</p>
+     <p class="note" role="note"><span>Note:</span> While <var>expressly granted</var> and <var>expressly denied</var> cannot both be true, they could both be false in User Agents which allow users to dismiss the prompt without choosing to allow or deny the request. (Such a dismissal is interpreted in this algorithm as a denial.)</p>
     <li data-md>
-     <p>Let <var>flag set</var> be the result of <a data-link-type="dfn" href="#obtain-the-storage-access-flag-set" id="ref-for-obtain-the-storage-access-flag-set③">obtaining the storage access flag set</a> of <var>doc</var>.</p>
+     <p>If <var>expressly granted</var> is true, run these steps:</p>
+     <ol>
+      <li data-md>
+       <p>Unset <var>flag set</var>’s <a data-link-type="dfn" href="#was-expressly-denied-storage-access-flag" id="ref-for-was-expressly-denied-storage-access-flag③">was expressly denied storage access flag</a>.</p>
+      <li data-md>
+       <p><a data-link-type="dfn" href="#save-the-storage-access-flag-set" id="ref-for-save-the-storage-access-flag-set②">Save the storage access flag set</a> for <var>key</var> in <var>map</var>.</p>
+      <li data-md>
+       <p><a data-link-type="dfn" href="https://heycam.github.io/webidl/#resolve" id="ref-for-resolve①①">Resolve</a> <var>p</var> and return.</p>
+     </ol>
     <li data-md>
-     <p>Unset <var>flag set</var>’s <a data-link-type="dfn" href="#has-storage-access-flag" id="ref-for-has-storage-access-flag④">has storage access flag</a>.</p>
+     <p>Unset <var>flag set</var>’s <a data-link-type="dfn" href="#has-storage-access-flag" id="ref-for-has-storage-access-flag⑤">has storage access flag</a>.</p>
     <li data-md>
      <p>If <var>expressly denied</var> is true, run these steps:</p>
      <ol>
       <li data-md>
        <p>If <var>doc</var>’s <code class="idl"><a data-link-type="idl" href="https://html.spec.whatwg.org/multipage/window-object.html#window" id="ref-for-window①">Window</a></code> object has <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/interaction.html#transient-activation" id="ref-for-transient-activation①">transient activation</a>, <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/interaction.html#consume-user-activation" id="ref-for-consume-user-activation">consume user activation</a> with it.</p>
       <li data-md>
-       <p>Set <var>flag set</var>’s <a data-link-type="dfn" href="#was-expressly-denied-storage-access-flag" id="ref-for-was-expressly-denied-storage-access-flag②">was expressly denied storage access flag</a>.</p>
+       <p>Set <var>flag set</var>’s <a data-link-type="dfn" href="#was-expressly-denied-storage-access-flag" id="ref-for-was-expressly-denied-storage-access-flag④">was expressly denied storage access flag</a>.</p>
      </ol>
     <li data-md>
-     <p><a data-link-type="dfn" href="https://heycam.github.io/webidl/#reject" id="ref-for-reject⑥">Reject</a> <var>p</var> and return.</p>
+     <p><a data-link-type="dfn" href="#save-the-storage-access-flag-set" id="ref-for-save-the-storage-access-flag-set③">Save the storage access flag set</a> for <var>key</var> in <var>map</var>.</p>
+    <li data-md>
+     <p><a data-link-type="dfn" href="https://heycam.github.io/webidl/#reject" id="ref-for-reject⑦">Reject</a> <var>p</var> and return.</p>
    </ol>
    <p class="issue" id="issue-65ce4cf9"><a class="self-link" href="#issue-65ce4cf9"></a> <a href="https://github.com/privacycg/storage-access/pull/24#discussion_r408784492">since this is UA-defined, does it make sense to follow-up separately with a user prompt?</a></p>
    <h3 class="heading settled" data-level="3.3" id="navigation"><span class="secno">3.3. </span><span class="content">Changes to navigation</span><a class="self-link" href="#navigation"></a></h3>
    <p>Before changing the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/history.html#current-entry" id="ref-for-current-entry">current entry</a> of a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/history.html#session-history" id="ref-for-session-history">session history</a>, run the following steps:</p>
    <ol>
     <li data-md>
-     <p>Let <var>flag set</var> be the result of <a data-link-type="dfn" href="#obtain-the-storage-access-flag-set" id="ref-for-obtain-the-storage-access-flag-set④">obtaining the storage access flag set</a> of <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/history.html#current-entry" id="ref-for-current-entry①">current entry</a>'s <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document①②">Document</a></code>.</p>
+     <p>Let <var>doc</var> be <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/history.html#current-entry" id="ref-for-current-entry①">current entry</a>'s <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document①②">Document</a></code>.</p>
     <li data-md>
-     <p>Unset <var>flag set</var>’s <a data-link-type="dfn" href="#has-storage-access-flag" id="ref-for-has-storage-access-flag⑤">has storage access flag</a>.</p>
+     <p>Let <var>map</var> be the result of <a data-link-type="dfn" href="#obtain-the-storage-access-map" id="ref-for-obtain-the-storage-access-map④">obtaining the storage access map</a> for <var>doc</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-document-bc" id="ref-for-concept-document-bc⑥">browsing context</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#top-level-browsing-context" id="ref-for-top-level-browsing-context⑦">top-level browsing context</a>.</p>
+    <li data-md>
+     <p>Let <var>key</var> be the result of <a data-link-type="dfn" href="#generate-a-partitioned-storage-key" id="ref-for-generate-a-partitioned-storage-key③">generating a partitioned storage key</a> from <var>doc</var>.</p>
+    <li data-md>
+     <p>If <var>key</var> is failure, abort these steps.</p>
+    <li data-md>
+     <p>Let <var>flag set</var> be the result of <a data-link-type="dfn" href="#obtain-a-storage-access-flag-set" id="ref-for-obtain-a-storage-access-flag-set④">obtaining the storage access flag set</a> with <var>key</var> from <var>map</var>.</p>
+    <li data-md>
+     <p>Unset <var>flag set</var>’s <a data-link-type="dfn" href="#has-storage-access-flag" id="ref-for-has-storage-access-flag⑥">has storage access flag</a>.</p>
+    <li data-md>
+     <p><a data-link-type="dfn" href="#save-the-storage-access-flag-set" id="ref-for-save-the-storage-access-flag-set④">Save the storage access flag set</a> for <var>key</var> in <var>map</var>.</p>
    </ol>
    <p class="issue" id="issue-0b5538d9"><a class="self-link" href="#issue-0b5538d9"></a> What this section should look like ultimately hinges on <a href="https://github.com/privacycg/storage-access/issues/3">&lt;https://github.com/privacycg/storage-access/issues/3></a></p>
    <h3 class="heading settled" data-level="3.4" id="storage"><span class="secno">3.4. </span><span class="content">Changes to various client-side storage mechanisms</span><a class="self-link" href="#storage"></a></h3>
-   <p class="issue" id="issue-82f734f9"><a class="self-link" href="#issue-82f734f9"></a> Write this section. For each kind of client-side storage affected, modify them to invoke <a data-link-type="dfn" href="#determine-if-a-document-has-storage-access" id="ref-for-determine-if-a-document-has-storage-access①">determine if a document has storage access</a> &amp; modify their behavior based on the result.</p>
+   <p class="issue" id="issue-322b6430"><a class="self-link" href="#issue-322b6430"></a> Write this section. For each kind of client-side storage affected, modify them to invoke <a data-link-type="dfn" href="#determine-if-a-site-has-storage-access" id="ref-for-determine-if-a-site-has-storage-access①">determine if a site has storage access</a> &amp; modify their behavior based on the result.</p>
    <p class="issue" id="issue-924f0e5d"><a class="self-link" href="#issue-924f0e5d"></a> Should this API affect client-side storage other than cookies? <a href="https://github.com/privacycg/storage-access/issues/4">&lt;https://github.com/privacycg/storage-access/issues/4></a></p>
    <h4 class="heading settled" data-level="3.4.1" id="cookies"><span class="secno">3.4.1. </span><span class="content">Cookies</span><a class="self-link" href="#cookies"></a></h4>
    <p class="issue" id="issue-089b92ec"><a class="self-link" href="#issue-089b92ec"></a> Write this section.</p>
@@ -1941,26 +2002,37 @@ <h2 class="no-num no-ref heading settled" id="index"><span class="content">Index
   <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="content">Terms defined by this specification</span><a class="self-link" href="#index-defined-here"></a></h3>
   <ul class="index">
    <li><a href="#attr-valuedef-iframe-sandbox-allow-storage-access-by-user-activation">allow-storage-access-by-user-activation</a><span>, in §3.5</span>
-   <li><a href="#determine-if-a-document-has-storage-access">determine if a document has storage access</a><span>, in §3.2.1</span>
+   <li><a href="#determine-if-a-site-has-storage-access">determine if a site has storage access</a><span>, in §3.2.1</span>
    <li><a href="#determine-the-storage-access-policy">determine the storage access policy</a><span>, in §3.2.1</span>
-   <li><a href="#first-party">first party</a><span>, in §3</span>
-   <li><a href="#first-party-data">first party data</a><span>, in §3</span>
+   <li><a href="#partitioned-storage-key-embedded-site">embedded site</a><span>, in §3.1</span>
+   <li><a href="#first-party-data">First party data</a><span>, in §3</span>
+   <li><a href="#first-party-site-context">first-party-site context</a><span>, in §3</span>
+   <li><a href="#generate-a-partitioned-storage-key">generate a partitioned storage key</a><span>, in §3.1</span>
+   <li><a href="#global-storage-access-map">global storage access map</a><span>, in §3.1</span>
    <li><a href="#dom-document-hasstorageaccess">hasStorageAccess()</a><span>, in §3.2</span>
    <li><a href="#has-storage-access-flag">has storage access flag</a><span>, in §3.1</span>
-   <li><a href="#obtain-the-storage-access-flag-set">obtain the storage access flag set</a><span>, in §3.1</span>
+   <li><a href="#obtain-a-storage-access-flag-set">obtain a storage access flag set</a><span>, in §3.1</span>
+   <li><a href="#obtain-the-storage-access-map">obtain the storage access map</a><span>, in §3.1</span>
    <li><a href="#partitioned-storage-key">partitioned storage key</a><span>, in §3.1</span>
    <li><a href="#dom-document-requeststorageaccess">requestStorageAccess()</a><span>, in §3.2</span>
    <li><a href="#sandbox-storage-access-by-user-activation-flag">sandbox storage access by user activation flag</a><span>, in §3.5</span>
+   <li><a href="#save-the-storage-access-flag-set">save the storage access flag set</a><span>, in §3.1</span>
    <li><a href="#storage-access-flag-set">storage access flag set</a><span>, in §3.1</span>
-   <li><a href="#storage-access-map">storage access map</a><span>, in §3.1</span>
-   <li><a href="#third-party">third party</a><span>, in §3</span>
+   <li>
+    storage access map
+    <ul>
+     <li><a href="#storage-access-map">definition of</a><span>, in §3.1</span>
+     <li><a href="#agent-cluster-storage-access-map">dfn for agent cluster</a><span>, in §3.1</span>
+    </ul>
+   <li><a href="#third-party-context">third party context</a><span>, in §3</span>
+   <li><a href="#partitioned-storage-key-top-level-site">top-level site</a><span>, in §3.1</span>
    <li><a href="#was-expressly-denied-storage-access-flag">was expressly denied storage access flag</a><span>, in §3.1</span>
   </ul>
   <aside class="dfn-panel" data-for="term-for-document">
    <a href="https://dom.spec.whatwg.org/#document">https://dom.spec.whatwg.org/#document</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-document">3. The Storage Access API</a> <a href="#ref-for-document①">(2)</a> <a href="#ref-for-document②">(3)</a> <a href="#ref-for-document③">(4)</a> <a href="#ref-for-document④">(5)</a>
-    <li><a href="#ref-for-document⑤">3.1. User Agent state related to storage access</a>
+    <li><a href="#ref-for-document">3. The Storage Access API</a> <a href="#ref-for-document①">(2)</a> <a href="#ref-for-document②">(3)</a> <a href="#ref-for-document③">(4)</a>
+    <li><a href="#ref-for-document④">3.1. User Agent state related to storage access</a> <a href="#ref-for-document⑤">(2)</a>
     <li><a href="#ref-for-document⑥">3.2. Changes to Document</a> <a href="#ref-for-document⑦">(2)</a> <a href="#ref-for-document⑧">(3)</a> <a href="#ref-for-document⑨">(4)</a>
     <li><a href="#ref-for-document①⓪">3.2.1. User Agent storage access policies</a> <a href="#ref-for-document①①">(2)</a>
     <li><a href="#ref-for-document①②">3.3. Changes to navigation</a>
@@ -1972,6 +2044,12 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     <li><a href="#ref-for-concept-document-origin">3.2. Changes to Document</a> <a href="#ref-for-concept-document-origin①">(2)</a>
    </ul>
   </aside>
+  <aside class="dfn-panel" data-for="term-for-sec-agent-clusters">
+   <a href="https://tc39.github.io/ecma262/#sec-agent-clusters">https://tc39.github.io/ecma262/#sec-agent-clusters</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-sec-agent-clusters">3.1. User Agent state related to storage access</a> <a href="#ref-for-sec-agent-clusters①">(2)</a> <a href="#ref-for-sec-agent-clusters②">(3)</a>
+   </ul>
+  </aside>
   <aside class="dfn-panel" data-for="term-for-window">
    <a href="https://html.spec.whatwg.org/multipage/window-object.html#window">https://html.spec.whatwg.org/multipage/window-object.html#window</a><b>Referenced in:</b>
    <ul>
@@ -1982,8 +2060,8 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
   <aside class="dfn-panel" data-for="term-for-active-document">
    <a href="https://html.spec.whatwg.org/multipage/browsers.html#active-document">https://html.spec.whatwg.org/multipage/browsers.html#active-document</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-active-document">3.2. Changes to Document</a> <a href="#ref-for-active-document①">(2)</a>
-    <li><a href="#ref-for-active-document②">3.2.1. User Agent storage access policies</a> <a href="#ref-for-active-document③">(2)</a>
+    <li><a href="#ref-for-active-document">3. The Storage Access API</a> <a href="#ref-for-active-document①">(2)</a>
+    <li><a href="#ref-for-active-document②">3.2. Changes to Document</a> <a href="#ref-for-active-document③">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-active-sandboxing-flag-set">
@@ -1995,8 +2073,9 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
   <aside class="dfn-panel" data-for="term-for-concept-document-bc">
    <a href="https://html.spec.whatwg.org/multipage/browsers.html#concept-document-bc">https://html.spec.whatwg.org/multipage/browsers.html#concept-document-bc</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-document-bc">3.2. Changes to Document</a> <a href="#ref-for-concept-document-bc①">(2)</a> <a href="#ref-for-concept-document-bc②">(3)</a> <a href="#ref-for-concept-document-bc③">(4)</a> <a href="#ref-for-concept-document-bc④">(5)</a>
-    <li><a href="#ref-for-concept-document-bc⑤">3.2.1. User Agent storage access policies</a> <a href="#ref-for-concept-document-bc⑥">(2)</a>
+    <li><a href="#ref-for-concept-document-bc">3.1. User Agent state related to storage access</a>
+    <li><a href="#ref-for-concept-document-bc①">3.2. Changes to Document</a> <a href="#ref-for-concept-document-bc②">(2)</a> <a href="#ref-for-concept-document-bc③">(3)</a> <a href="#ref-for-concept-document-bc④">(4)</a> <a href="#ref-for-concept-document-bc⑤">(5)</a>
+    <li><a href="#ref-for-concept-document-bc⑥">3.3. Changes to navigation</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-consume-user-activation">
@@ -2027,8 +2106,8 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <a href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element">https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element</a><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-the-iframe-element">1. Introduction</a> <a href="#ref-for-the-iframe-element①">(2)</a>
-    <li><a href="#ref-for-the-iframe-element②">3. The Storage Access API</a> <a href="#ref-for-the-iframe-element③">(2)</a>
-    <li><a href="#ref-for-the-iframe-element④">3.2. Changes to Document</a>
+    <li><a href="#ref-for-the-iframe-element②">3. The Storage Access API</a> <a href="#ref-for-the-iframe-element③">(2)</a> <a href="#ref-for-the-iframe-element④">(3)</a>
+    <li><a href="#ref-for-the-iframe-element⑤">3.2. Changes to Document</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-obtain-a-site">
@@ -2062,6 +2141,12 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     <li><a href="#ref-for-parse-a-sandboxing-directive">3.5. Sandboxing storage access</a>
    </ul>
   </aside>
+  <aside class="dfn-panel" data-for="term-for-relevant-agent">
+   <a href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-agent">https://html.spec.whatwg.org/multipage/webappapis.html#relevant-agent</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-relevant-agent">3.1. User Agent state related to storage access</a>
+   </ul>
+  </aside>
   <aside class="dfn-panel" data-for="term-for-relevant-settings-object">
    <a href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object">https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object</a><b>Referenced in:</b>
    <ul>
@@ -2097,7 +2182,9 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
   <aside class="dfn-panel" data-for="term-for-site">
    <a href="https://html.spec.whatwg.org/multipage/origin.html#site">https://html.spec.whatwg.org/multipage/origin.html#site</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-site">3.1. User Agent state related to storage access</a>
+    <li><a href="#ref-for-site">3. The Storage Access API</a>
+    <li><a href="#ref-for-site①">3.1. User Agent state related to storage access</a>
+    <li><a href="#ref-for-site②">3.2.1. User Agent storage access policies</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-starting-a-new-parallel-queue">
@@ -2109,8 +2196,10 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
   <aside class="dfn-panel" data-for="term-for-top-level-browsing-context">
    <a href="https://html.spec.whatwg.org/multipage/browsers.html#top-level-browsing-context">https://html.spec.whatwg.org/multipage/browsers.html#top-level-browsing-context</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-top-level-browsing-context">3.2. Changes to Document</a> <a href="#ref-for-top-level-browsing-context①">(2)</a> <a href="#ref-for-top-level-browsing-context②">(3)</a> <a href="#ref-for-top-level-browsing-context③">(4)</a> <a href="#ref-for-top-level-browsing-context④">(5)</a>
-    <li><a href="#ref-for-top-level-browsing-context⑤">3.2.1. User Agent storage access policies</a> <a href="#ref-for-top-level-browsing-context⑥">(2)</a>
+    <li><a href="#ref-for-top-level-browsing-context">3. The Storage Access API</a>
+    <li><a href="#ref-for-top-level-browsing-context①">3.1. User Agent state related to storage access</a>
+    <li><a href="#ref-for-top-level-browsing-context②">3.2. Changes to Document</a> <a href="#ref-for-top-level-browsing-context③">(2)</a> <a href="#ref-for-top-level-browsing-context④">(3)</a> <a href="#ref-for-top-level-browsing-context⑤">(4)</a> <a href="#ref-for-top-level-browsing-context⑥">(5)</a>
+    <li><a href="#ref-for-top-level-browsing-context⑦">3.3. Changes to navigation</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-top-level-origin">
@@ -2133,28 +2222,40 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     <li><a href="#ref-for-boolean">3.2.1. User Agent storage access policies</a> <a href="#ref-for-boolean①">(2)</a> <a href="#ref-for-boolean②">(3)</a>
    </ul>
   </aside>
+  <aside class="dfn-panel" data-for="term-for-map-clone">
+   <a href="https://infra.spec.whatwg.org/#map-clone">https://infra.spec.whatwg.org/#map-clone</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-map-clone">3.1. User Agent state related to storage access</a>
+   </ul>
+  </aside>
   <aside class="dfn-panel" data-for="term-for-map-exists">
    <a href="https://infra.spec.whatwg.org/#map-exists">https://infra.spec.whatwg.org/#map-exists</a><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-map-exists">3.1. User Agent state related to storage access</a>
    </ul>
   </aside>
+  <aside class="dfn-panel" data-for="term-for-implementation-defined">
+   <a href="https://infra.spec.whatwg.org/#implementation-defined">https://infra.spec.whatwg.org/#implementation-defined</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-implementation-defined">3.2.1. User Agent storage access policies</a> <a href="#ref-for-implementation-defined①">(2)</a> <a href="#ref-for-implementation-defined②">(3)</a>
+   </ul>
+  </aside>
   <aside class="dfn-panel" data-for="term-for-ordered-map">
    <a href="https://infra.spec.whatwg.org/#ordered-map">https://infra.spec.whatwg.org/#ordered-map</a><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-ordered-map">3.1. User Agent state related to storage access</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="term-for-pair">
-   <a href="https://infra.spec.whatwg.org/#pair">https://infra.spec.whatwg.org/#pair</a><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="term-for-map-set">
+   <a href="https://infra.spec.whatwg.org/#map-set">https://infra.spec.whatwg.org/#map-set</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-pair">3.1. User Agent state related to storage access</a> <a href="#ref-for-pair①">(2)</a>
+    <li><a href="#ref-for-map-set">3.1. User Agent state related to storage access</a> <a href="#ref-for-map-set①">(2)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="term-for-map-set">
-   <a href="https://infra.spec.whatwg.org/#map-set">https://infra.spec.whatwg.org/#map-set</a><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="term-for-tuple">
+   <a href="https://infra.spec.whatwg.org/#tuple">https://infra.spec.whatwg.org/#tuple</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-map-set">3.1. User Agent state related to storage access</a>
+    <li><a href="#ref-for-tuple">3.1. User Agent state related to storage access</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-idl-promise">
@@ -2178,15 +2279,15 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
   <aside class="dfn-panel" data-for="term-for-reject">
    <a href="https://heycam.github.io/webidl/#reject">https://heycam.github.io/webidl/#reject</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-reject">3.2. Changes to Document</a> <a href="#ref-for-reject①">(2)</a> <a href="#ref-for-reject②">(3)</a> <a href="#ref-for-reject③">(4)</a> <a href="#ref-for-reject④">(5)</a>
-    <li><a href="#ref-for-reject⑤">3.2.1. User Agent storage access policies</a> <a href="#ref-for-reject⑥">(2)</a>
+    <li><a href="#ref-for-reject">3.2. Changes to Document</a> <a href="#ref-for-reject①">(2)</a> <a href="#ref-for-reject②">(3)</a> <a href="#ref-for-reject③">(4)</a> <a href="#ref-for-reject④">(5)</a> <a href="#ref-for-reject⑤">(6)</a>
+    <li><a href="#ref-for-reject⑥">3.2.1. User Agent storage access policies</a> <a href="#ref-for-reject⑦">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-resolve">
    <a href="https://heycam.github.io/webidl/#resolve">https://heycam.github.io/webidl/#resolve</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-resolve">3.2. Changes to Document</a> <a href="#ref-for-resolve①">(2)</a> <a href="#ref-for-resolve②">(3)</a> <a href="#ref-for-resolve③">(4)</a> <a href="#ref-for-resolve④">(5)</a> <a href="#ref-for-resolve⑤">(6)</a> <a href="#ref-for-resolve⑥">(7)</a> <a href="#ref-for-resolve⑦">(8)</a>
-    <li><a href="#ref-for-resolve⑧">3.2.1. User Agent storage access policies</a> <a href="#ref-for-resolve⑨">(2)</a>
+    <li><a href="#ref-for-resolve">3.2. Changes to Document</a> <a href="#ref-for-resolve①">(2)</a> <a href="#ref-for-resolve②">(3)</a> <a href="#ref-for-resolve③">(4)</a> <a href="#ref-for-resolve④">(5)</a> <a href="#ref-for-resolve⑤">(6)</a> <a href="#ref-for-resolve⑥">(7)</a> <a href="#ref-for-resolve⑦">(8)</a> <a href="#ref-for-resolve⑧">(9)</a> <a href="#ref-for-resolve⑨">(10)</a>
+    <li><a href="#ref-for-resolve①⓪">3.2.1. User Agent storage access policies</a> <a href="#ref-for-resolve①①">(2)</a>
    </ul>
   </aside>
   <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span class="content">Terms defined by reference</span><a class="self-link" href="#index-defined-elsewhere"></a></h3>
@@ -2197,6 +2298,11 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="term-for-document" style="color:initial">Document</span>
      <li><span class="dfn-paneled" id="term-for-concept-document-origin" style="color:initial">origin</span>
     </ul>
+   <li>
+    <a data-link-type="biblio">[ECMASCRIPT]</a> defines the following terms:
+    <ul>
+     <li><span class="dfn-paneled" id="term-for-sec-agent-clusters" style="color:initial">agent cluster</span>
+    </ul>
    <li>
     <a data-link-type="biblio">[HTML]</a> defines the following terms:
     <ul>
@@ -2214,6 +2320,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="term-for-opener-browsing-context" style="color:initial">opener browsing context</span>
      <li><span class="dfn-paneled" id="term-for-concept-settings-object-origin" style="color:initial">origin</span>
      <li><span class="dfn-paneled" id="term-for-parse-a-sandboxing-directive" style="color:initial">parse a sandboxing directive</span>
+     <li><span class="dfn-paneled" id="term-for-relevant-agent" style="color:initial">relevant agent</span>
      <li><span class="dfn-paneled" id="term-for-relevant-settings-object" style="color:initial">relevant settings object</span>
      <li><span class="dfn-paneled" id="term-for-same-origin" style="color:initial">same origin</span>
      <li><span class="dfn-paneled" id="term-for-same-site" style="color:initial">same site</span>
@@ -2229,10 +2336,12 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
     <a data-link-type="biblio">[INFRA]</a> defines the following terms:
     <ul>
      <li><span class="dfn-paneled" id="term-for-boolean" style="color:initial">boolean</span>
+     <li><span class="dfn-paneled" id="term-for-map-clone" style="color:initial">clone</span>
      <li><span class="dfn-paneled" id="term-for-map-exists" style="color:initial">exist</span>
-     <li><span class="dfn-paneled" id="term-for-ordered-map" style="color:initial">ordered map</span>
-     <li><span class="dfn-paneled" id="term-for-pair" style="color:initial">pair</span>
+     <li><span class="dfn-paneled" id="term-for-implementation-defined" style="color:initial">implementation-defined</span>
+     <li><span class="dfn-paneled" id="term-for-ordered-map" style="color:initial">map</span>
      <li><span class="dfn-paneled" id="term-for-map-set" style="color:initial">set</span>
+     <li><span class="dfn-paneled" id="term-for-tuple" style="color:initial">tuple</span>
     </ul>
    <li>
     <a data-link-type="biblio">[WebIDL]</a> defines the following terms:
@@ -2249,14 +2358,14 @@ <h3 class="no-num no-ref heading settled" id="normative"><span class="content">N
   <dl>
    <dt id="biblio-dom">[DOM]
    <dd>Anne van Kesteren. <a href="https://dom.spec.whatwg.org/">DOM Standard</a>. Living Standard. URL: <a href="https://dom.spec.whatwg.org/">https://dom.spec.whatwg.org/</a>
+   <dt id="biblio-ecmascript">[ECMASCRIPT]
+   <dd><a href="https://tc39.es/ecma262/">ECMAScript Language Specification</a>. URL: <a href="https://tc39.es/ecma262/">https://tc39.es/ecma262/</a>
    <dt id="biblio-html">[HTML]
    <dd>Anne van Kesteren; et al. <a href="https://html.spec.whatwg.org/multipage/">HTML Standard</a>. Living Standard. URL: <a href="https://html.spec.whatwg.org/multipage/">https://html.spec.whatwg.org/multipage/</a>
    <dt id="biblio-infra">[INFRA]
    <dd>Anne van Kesteren; Domenic Denicola. <a href="https://infra.spec.whatwg.org/">Infra Standard</a>. Living Standard. URL: <a href="https://infra.spec.whatwg.org/">https://infra.spec.whatwg.org/</a>
    <dt id="biblio-rfc2119">[RFC2119]
    <dd>S. Bradner. <a href="https://tools.ietf.org/html/rfc2119">Key words for use in RFCs to Indicate Requirement Levels</a>. March 1997. Best Current Practice. URL: <a href="https://tools.ietf.org/html/rfc2119">https://tools.ietf.org/html/rfc2119</a>
-   <dt id="biblio-storage">[STORAGE]
-   <dd>Anne van Kesteren. <a href="https://storage.spec.whatwg.org/">Storage Standard</a>. Living Standard. URL: <a href="https://storage.spec.whatwg.org/">https://storage.spec.whatwg.org/</a>
    <dt id="biblio-webidl">[WebIDL]
    <dd>Boris Zbarsky. <a href="https://heycam.github.io/webidl/">Web IDL</a>. 15 December 2016. ED. URL: <a href="https://heycam.github.io/webidl/">https://heycam.github.io/webidl/</a>
   </dl>
@@ -2274,53 +2383,95 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
 </pre>
   <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content">Issues Index</span><a class="self-link" href="#issues-index"></a></h2>
   <div style="counter-reset:issue">
-   <div class="issue"> What’s the lifetime of the <a data-link-type="dfn" href="#storage-access-map">storage access map</a> and of its entries?<a href="#issue-308d22de"> ↵ </a></div>
-   <div class="issue"> Tie the <a data-link-type="dfn" href="#storage-access-map">storage access map</a> to agent clusters. <a href="https://github.com/privacycg/storage-access/issues/28">&lt;https://github.com/privacycg/storage-access/issues/28></a><a href="#issue-e9bb7e96"> ↵ </a></div>
-   <div class="issue"> Replace this <a data-link-type="dfn" href="#partitioned-storage-key">partitioned storage key</a> concept with whatever Anne comes up with for <a data-link-type="biblio" href="#biblio-storage">[STORAGE]</a>.<a href="#issue-bf438984"> ↵ </a></div>
+   <div class="issue"> If we let nested <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element">iframe</a></code>s use this API, we may have to revisit these definitions. <a href="https://github.com/privacycg/storage-access/issues/10">&lt;https://github.com/privacycg/storage-access/issues/10></a><a href="#issue-b7678c76"> ↵ </a></div>
+   <div class="issue"> What is the lifecycle of the <a data-link-type="dfn" href="#global-storage-access-map">global storage access map</a>? How long do we remember its contents? Firefox and Safari differ here. <a href="https://github.com/privacycg/storage-access/issues/2">&lt;https://github.com/privacycg/storage-access/issues/2></a><a href="#issue-c97088f3"> ↵ </a></div>
+   <div class="issue"> When do we age out entries in the <a data-link-type="dfn" href="#global-storage-access-map">global storage access map</a>? See also <a href="https://github.com/privacycg/storage-access#scope-of-storage-access">Scope of Storage Access</a>. <a href="https://github.com/privacycg/storage-access/issues/5">&lt;https://github.com/privacycg/storage-access/issues/5></a><a href="#issue-5b7f617d"> ↵ </a></div>
    <div class="issue"> Shouldn’t step 7 be <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#same-site">same site</a>?<a href="#issue-9416e44b"> ↵ </a></div>
    <div class="issue"> Shouldn’t step 3.7 be <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#same-site">same site</a>?<a href="#issue-18c86ea4"> ↵ </a></div>
    <div class="issue"> Remove step 3.9 if we determine that nested <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element">iframe</a></code>s should be able to request storage access. <a href="https://github.com/privacycg/storage-access/issues/10">&lt;https://github.com/privacycg/storage-access/issues/10></a><a href="#issue-41e7fe80"> ↵ </a></div>
    <div class="issue"> <a href="https://github.com/privacycg/storage-access/pull/24#discussion_r408784492">since this is UA-defined, does it make sense to follow-up separately with a user prompt?</a><a href="#issue-65ce4cf9"> ↵ </a></div>
    <div class="issue"> What this section should look like ultimately hinges on <a href="https://github.com/privacycg/storage-access/issues/3">&lt;https://github.com/privacycg/storage-access/issues/3></a><a href="#issue-0b5538d9"> ↵ </a></div>
-   <div class="issue"> Write this section. For each kind of client-side storage affected, modify them to invoke <a data-link-type="dfn" href="#determine-if-a-document-has-storage-access">determine if a document has storage access</a> &amp; modify their behavior based on the result.<a href="#issue-82f734f9"> ↵ </a></div>
+   <div class="issue"> Write this section. For each kind of client-side storage affected, modify them to invoke <a data-link-type="dfn" href="#determine-if-a-site-has-storage-access">determine if a site has storage access</a> &amp; modify their behavior based on the result.<a href="#issue-322b6430"> ↵ </a></div>
    <div class="issue"> Should this API affect client-side storage other than cookies? <a href="https://github.com/privacycg/storage-access/issues/4">&lt;https://github.com/privacycg/storage-access/issues/4></a><a href="#issue-924f0e5d"> ↵ </a></div>
    <div class="issue"> Write this section.<a href="#issue-089b92ec"> ↵ </a></div>
    <div class="issue"> What about Feature Policy? <a href="https://github.com/privacycg/storage-access/issues/12">&lt;https://github.com/privacycg/storage-access/issues/12></a><a href="#issue-4c448f45"> ↵ </a></div>
    <div class="issue"> Write this section.<a href="#issue-089b92ec①"> ↵ </a></div>
    <div class="issue"> Write this section.<a href="#issue-089b92ec②"> ↵ </a></div>
   </div>
-  <aside class="dfn-panel" data-for="first-party">
-   <b><a href="#first-party">#first-party</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="first-party-data">
+   <b><a href="#first-party-data">#first-party-data</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-first-party">3. The Storage Access API</a>
+    <li><a href="#ref-for-first-party-data">3. The Storage Access API</a> <a href="#ref-for-first-party-data①">(2)</a>
+    <li><a href="#ref-for-first-party-data②">3.1. User Agent state related to storage access</a> <a href="#ref-for-first-party-data③">(2)</a>
+    <li><a href="#ref-for-first-party-data④">3.2.1. User Agent storage access policies</a> <a href="#ref-for-first-party-data⑤">(2)</a> <a href="#ref-for-first-party-data⑥">(3)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="third-party">
-   <b><a href="#third-party">#third-party</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="first-party-site-context">
+   <b><a href="#first-party-site-context">#first-party-site-context</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-third-party">3. The Storage Access API</a>
-    <li><a href="#ref-for-third-party①">3.1. User Agent state related to storage access</a> <a href="#ref-for-third-party②">(2)</a> <a href="#ref-for-third-party③">(3)</a>
-    <li><a href="#ref-for-third-party④">3.2.1. User Agent storage access policies</a> <a href="#ref-for-third-party⑤">(2)</a> <a href="#ref-for-third-party⑥">(3)</a>
+    <li><a href="#ref-for-first-party-site-context">3. The Storage Access API</a> <a href="#ref-for-first-party-site-context①">(2)</a> <a href="#ref-for-first-party-site-context②">(3)</a> <a href="#ref-for-first-party-site-context③">(4)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="first-party-data">
-   <b><a href="#first-party-data">#first-party-data</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="third-party-context">
+   <b><a href="#third-party-context">#third-party-context</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-first-party-data">3. The Storage Access API</a> <a href="#ref-for-first-party-data①">(2)</a>
-    <li><a href="#ref-for-first-party-data②">3.1. User Agent state related to storage access</a> <a href="#ref-for-first-party-data③">(2)</a>
-    <li><a href="#ref-for-first-party-data④">3.2.1. User Agent storage access policies</a> <a href="#ref-for-first-party-data⑤">(2)</a> <a href="#ref-for-first-party-data⑥">(3)</a>
+    <li><a href="#ref-for-third-party-context">3. The Storage Access API</a>
+    <li><a href="#ref-for-third-party-context①">3.1. User Agent state related to storage access</a> <a href="#ref-for-third-party-context②">(2)</a> <a href="#ref-for-third-party-context③">(3)</a>
+    <li><a href="#ref-for-third-party-context④">3.2.1. User Agent storage access policies</a> <a href="#ref-for-third-party-context⑤">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="storage-access-map">
    <b><a href="#storage-access-map">#storage-access-map</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-storage-access-map">3.1. User Agent state related to storage access</a> <a href="#ref-for-storage-access-map①">(2)</a> <a href="#ref-for-storage-access-map②">(3)</a> <a href="#ref-for-storage-access-map③">(4)</a> <a href="#ref-for-storage-access-map④">(5)</a>
+    <li><a href="#ref-for-storage-access-map">3.1. User Agent state related to storage access</a> <a href="#ref-for-storage-access-map①">(2)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="global-storage-access-map">
+   <b><a href="#global-storage-access-map">#global-storage-access-map</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-global-storage-access-map">3.1. User Agent state related to storage access</a> <a href="#ref-for-global-storage-access-map①">(2)</a> <a href="#ref-for-global-storage-access-map②">(3)</a> <a href="#ref-for-global-storage-access-map③">(4)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="agent-cluster-storage-access-map">
+   <b><a href="#agent-cluster-storage-access-map">#agent-cluster-storage-access-map</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-agent-cluster-storage-access-map">3.1. User Agent state related to storage access</a> <a href="#ref-for-agent-cluster-storage-access-map①">(2)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="obtain-the-storage-access-map">
+   <b><a href="#obtain-the-storage-access-map">#obtain-the-storage-access-map</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-obtain-the-storage-access-map">3.2. Changes to Document</a> <a href="#ref-for-obtain-the-storage-access-map①">(2)</a>
+    <li><a href="#ref-for-obtain-the-storage-access-map②">3.2.1. User Agent storage access policies</a> <a href="#ref-for-obtain-the-storage-access-map③">(2)</a>
+    <li><a href="#ref-for-obtain-the-storage-access-map④">3.3. Changes to navigation</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="partitioned-storage-key">
    <b><a href="#partitioned-storage-key">#partitioned-storage-key</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-partitioned-storage-key">3.1. User Agent state related to storage access</a> <a href="#ref-for-partitioned-storage-key①">(2)</a>
+    <li><a href="#ref-for-partitioned-storage-key">3.1. User Agent state related to storage access</a> <a href="#ref-for-partitioned-storage-key①">(2)</a> <a href="#ref-for-partitioned-storage-key②">(3)</a> <a href="#ref-for-partitioned-storage-key③">(4)</a> <a href="#ref-for-partitioned-storage-key④">(5)</a> <a href="#ref-for-partitioned-storage-key⑤">(6)</a>
+    <li><a href="#ref-for-partitioned-storage-key⑥">3.2.1. User Agent storage access policies</a> <a href="#ref-for-partitioned-storage-key⑦">(2)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="partitioned-storage-key-top-level-site">
+   <b><a href="#partitioned-storage-key-top-level-site">#partitioned-storage-key-top-level-site</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-partitioned-storage-key-top-level-site">3.1. User Agent state related to storage access</a>
+    <li><a href="#ref-for-partitioned-storage-key-top-level-site①">3.2.1. User Agent storage access policies</a> <a href="#ref-for-partitioned-storage-key-top-level-site②">(2)</a> <a href="#ref-for-partitioned-storage-key-top-level-site③">(3)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="partitioned-storage-key-embedded-site">
+   <b><a href="#partitioned-storage-key-embedded-site">#partitioned-storage-key-embedded-site</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-partitioned-storage-key-embedded-site">3.1. User Agent state related to storage access</a>
+    <li><a href="#ref-for-partitioned-storage-key-embedded-site①">3.2.1. User Agent storage access policies</a> <a href="#ref-for-partitioned-storage-key-embedded-site②">(2)</a> <a href="#ref-for-partitioned-storage-key-embedded-site③">(3)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="generate-a-partitioned-storage-key">
+   <b><a href="#generate-a-partitioned-storage-key">#generate-a-partitioned-storage-key</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-generate-a-partitioned-storage-key">3.2. Changes to Document</a> <a href="#ref-for-generate-a-partitioned-storage-key①">(2)</a> <a href="#ref-for-generate-a-partitioned-storage-key②">(3)</a>
+    <li><a href="#ref-for-generate-a-partitioned-storage-key③">3.3. Changes to navigation</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="storage-access-flag-set">
@@ -2333,23 +2484,31 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
    <b><a href="#has-storage-access-flag">#has-storage-access-flag</a></b><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-has-storage-access-flag">3.2. Changes to Document</a> <a href="#ref-for-has-storage-access-flag①">(2)</a>
-    <li><a href="#ref-for-has-storage-access-flag②">3.2.1. User Agent storage access policies</a> <a href="#ref-for-has-storage-access-flag③">(2)</a> <a href="#ref-for-has-storage-access-flag④">(3)</a>
-    <li><a href="#ref-for-has-storage-access-flag⑤">3.3. Changes to navigation</a>
+    <li><a href="#ref-for-has-storage-access-flag②">3.2.1. User Agent storage access policies</a> <a href="#ref-for-has-storage-access-flag③">(2)</a> <a href="#ref-for-has-storage-access-flag④">(3)</a> <a href="#ref-for-has-storage-access-flag⑤">(4)</a>
+    <li><a href="#ref-for-has-storage-access-flag⑥">3.3. Changes to navigation</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="was-expressly-denied-storage-access-flag">
    <b><a href="#was-expressly-denied-storage-access-flag">#was-expressly-denied-storage-access-flag</a></b><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-was-expressly-denied-storage-access-flag">3.2. Changes to Document</a> <a href="#ref-for-was-expressly-denied-storage-access-flag①">(2)</a>
-    <li><a href="#ref-for-was-expressly-denied-storage-access-flag②">3.2.1. User Agent storage access policies</a>
+    <li><a href="#ref-for-was-expressly-denied-storage-access-flag②">3.2.1. User Agent storage access policies</a> <a href="#ref-for-was-expressly-denied-storage-access-flag③">(2)</a> <a href="#ref-for-was-expressly-denied-storage-access-flag④">(3)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="obtain-a-storage-access-flag-set">
+   <b><a href="#obtain-a-storage-access-flag-set">#obtain-a-storage-access-flag-set</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-obtain-a-storage-access-flag-set">3.2. Changes to Document</a> <a href="#ref-for-obtain-a-storage-access-flag-set①">(2)</a>
+    <li><a href="#ref-for-obtain-a-storage-access-flag-set②">3.2.1. User Agent storage access policies</a> <a href="#ref-for-obtain-a-storage-access-flag-set③">(2)</a>
+    <li><a href="#ref-for-obtain-a-storage-access-flag-set④">3.3. Changes to navigation</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="obtain-the-storage-access-flag-set">
-   <b><a href="#obtain-the-storage-access-flag-set">#obtain-the-storage-access-flag-set</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="save-the-storage-access-flag-set">
+   <b><a href="#save-the-storage-access-flag-set">#save-the-storage-access-flag-set</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-obtain-the-storage-access-flag-set">3.2. Changes to Document</a> <a href="#ref-for-obtain-the-storage-access-flag-set①">(2)</a>
-    <li><a href="#ref-for-obtain-the-storage-access-flag-set②">3.2.1. User Agent storage access policies</a> <a href="#ref-for-obtain-the-storage-access-flag-set③">(2)</a>
-    <li><a href="#ref-for-obtain-the-storage-access-flag-set④">3.3. Changes to navigation</a>
+    <li><a href="#ref-for-save-the-storage-access-flag-set">3.2. Changes to Document</a>
+    <li><a href="#ref-for-save-the-storage-access-flag-set①">3.2.1. User Agent storage access policies</a> <a href="#ref-for-save-the-storage-access-flag-set②">(2)</a> <a href="#ref-for-save-the-storage-access-flag-set③">(3)</a>
+    <li><a href="#ref-for-save-the-storage-access-flag-set④">3.3. Changes to navigation</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-document-hasstorageaccess">
@@ -2369,11 +2528,11 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-dom-document-requeststorageaccess④">4. Privacy considerations</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="determine-if-a-document-has-storage-access">
-   <b><a href="#determine-if-a-document-has-storage-access">#determine-if-a-document-has-storage-access</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="determine-if-a-site-has-storage-access">
+   <b><a href="#determine-if-a-site-has-storage-access">#determine-if-a-site-has-storage-access</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-determine-if-a-document-has-storage-access">3.2. Changes to Document</a>
-    <li><a href="#ref-for-determine-if-a-document-has-storage-access①">3.4. Changes to various client-side storage mechanisms</a>
+    <li><a href="#ref-for-determine-if-a-site-has-storage-access">3.2. Changes to Document</a>
+    <li><a href="#ref-for-determine-if-a-site-has-storage-access①">3.4. Changes to various client-side storage mechanisms</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="determine-the-storage-access-policy">
diff --git a/storage-access.bs b/storage-access.bs
index dffc2c9..13c069c 100644
--- a/storage-access.bs
+++ b/storage-access.bs
@@ -15,15 +15,19 @@ Markup Shorthands: markdown yes, css no
 Complain About: accidental-2119 true
 </pre>
 
+<!-- File issues on HTML to export each of these -->
 <pre class=link-defaults>
-spec:infra; type:dfn; for:map; text:exist
-spec:infra; type:dfn; for:map; text:set
-spec:webidl; type:dfn; text:resolve
-spec:html; type:dfn; for:/; text:browsing context
 spec:html; type:dfn; text:session history; url:https://html.spec.whatwg.org/multipage/history.html#session-history
 spec:html; type:dfn; text:current entry; url:https://html.spec.whatwg.org/multipage/history.html#current-entry
 </pre>
 
+<pre class="anchors">
+urlPrefix: https://tc39.github.io/ecma262/; spec: ECMASCRIPT
+    text: agent cluster; url: #sec-agent-clusters; type: dfn
+urlPrefix: https://infra.spec.whatwg.org/; spec: INFRA
+    text: implementation-defined; url: #implementation-defined; type: dfn
+</pre>
+
 <pre class=biblio>
 {
     "STORAGE-ACCESS-INTRO": {
@@ -65,53 +69,77 @@ This specification depends on the Infra standard. [[!INFRA]]
 
 <h2 id="the-storage-access-api">The Storage Access API</h2>
 
-A {{Document}} is said to be <dfn>first party</dfn> when the [=environment settings object/origin=] and [=top-level origin=] of its [=relevant settings object=] are [=same site=] with one another. Otherwise, it is said to be <dfn>third party</dfn>.
-
-The <dfn>first party data</dfn> of a {{Document}} is the client-side storage it would normally have access to if it were [=first party=].
-
-This specification defines a method to query whether or not a {{Document}} currently has access to its [=first party data=] ({{Document/hasStorageAccess()}}), and a method that can be used to request access to a {{Document}}'s [=first party data=] ({{Document/requestStorageAccess()}}).
+This specification defines a method to query whether or not a {{Document}} currently has access to its [=first party data=] ({{Document/hasStorageAccess()}}), and a method that can be used to request access to its [=first party data=] ({{Document/requestStorageAccess()}}).
 
 <div class=example>
 
-Alex visits `https://social.example/`. The page sets a cookie. This cookie has been set in a first party context.
+Alex visits `https://social.example/`. The page sets a cookie. This cookie has been set in a [=first-party-site context=].
 
-Later on, Alex visits `https://video.example/`, which has an <{iframe}> on it which loads `https://social.example/heart-button-widget`. In this case, the `social.example` {{Document}} |doc| is [=third party=], and the cookie set previously might or might not be visible from |doc|`.`{{Document/cookie}}, depending on User Agent storage access policies.
+Later on, Alex visits `https://video.example/`, which has an <{iframe}> on it which loads `https://social.example/heart-button`. In this case, the `social.example` {{Document}} |doc| is in a [=third party context=], and the cookie set previously might or might not be visible from |doc|`.`{{Document/cookie}}, depending on User Agent storage access policies.
 
 Script in the <{iframe}> can call |doc|`.`{{Document/hasStorageAccess()}} to determine if it has access to the cookie. If it does not have access, it can request access by calling |doc|`.`{{Document/requestStorageAccess()}}.
 
 </div>
 
+<dfn>First party data</dfn> is client-side storage that would be available to a [=site=] were it loaded in a [=first-party-site context=].
+
+A {{Document}} is in a <dfn>first-party-site context</dfn> if it is the [=active document=] of a [=top-level browsing context=]. Otherwise, it is in a [=first-party-site context=] if it is an [=active document=] and the [=environment settings object/origin=] and [=top-level origin=] of its [=relevant settings object=] are [=same site=] with one another.
+
+A {{Document}} is in a <dfn>third party context</dfn> if it is not in a [=first-party-site context=].
+
+ISSUE(10): If we let nested <{iframe}>s use this API, we may have to revisit these definitions.
+
 <h3 id="ua-state">User Agent state related to storage access</h3>
 
-Each User Agent maintains a <dfn>storage access map</dfn>, an [=ordered map=] whose keys are [=partitioned storage keys=] and whose values are [=storage access flag sets=].
+A <dfn>storage access map</dfn> is a [=map=] whose keys are [=partitioned storage keys=] and whose values are [=storage access flag sets=].
 
-ISSUE: What's the lifetime of the [=storage access map=] and of its entries?
+User Agents maintain a single <dfn>global storage access map</dfn>.
 
-ISSUE(28): Tie the [=storage access map=] to agent clusters.
+ISSUE(2): What is the lifecycle of the [=global storage access map=]? How long do we remember its contents? Firefox and Safari differ here.
 
-A <dfn>partitioned storage key</dfn> is a [=pair=] consisting of a top-level site and a site, both [=sites=].
+ISSUE(5): When do we age out entries in the [=global storage access map=]? See also [Scope of Storage Access](https://github.com/privacycg/storage-access#scope-of-storage-access).
 
-ISSUE: Replace this [=partitioned storage key=] concept with whatever Anne comes up with for [[!STORAGE]].
+Each [=agent cluster=] has a <dfn for="agent cluster">storage access map</dfn>.
 
-A <dfn>storage access flag set</dfn> is a set of zero or more of the following flags, which are used to gate access to client-side storage for |site| when it's a [=third party=] on |top-level site|:
+When an [=agent cluster=] is created, its [=agent cluster/storage access map=] is initialized with a [=map/clone=] of the [=global storage access map=].
 
-: The <dfn for="storage access flag set" id=has-storage-access-flag>has storage access flag</dfn>
-:: When set, this flag indicates |site| has access to its [=first party data=] when it's a [=third party=] on |top-level site|.
-: The <dfn for="storage access flag set" id=was-expressly-denied-storage-access-flag>was expressly denied storage access flag</dfn>
-:: When set, this flag indicates that the user expressly denied |site| access to its [=first party data=] when it's a [=third party=] on |top-level site|.
+To <dfn type="abstract-op">obtain the storage access map</dfn> for a {{Document}} |doc|, run the following steps:
+
+1. Return the [=agent cluster/storage access map=] of |doc|'s [=relevant agent=]'s [=agent cluster=].
+
+A <dfn>partitioned storage key</dfn> is a [=tuple=] consisting of a <dfn for="partitioned storage key">top-level site</dfn> and an <dfn for="partitioned storage key">embedded site</dfn> (both [=sites=]).
+
+<div class=example>
 
-To <dfn type="abstract-op">obtain the storage access flag set</dfn> for a {{Document}} |doc|, run the following steps:
+`(("https", "news.example"), ("https", "social.example"))` is a [=partitioned storage key=] whose [=top-level site=] is `("https", "news.example")` and whose [=embedded site=] is `("https", "social.example")`.
+
+</div>
+
+To <dfn type="abstract-op">generate a partitioned storage key</dfn> for a {{Document}} |doc|, run the following steps:
 
 1. Let |settings| be |doc|'s [=relevant settings object=].
 1. Let |site| be the result of [=obtain a site|obtaining a site=] from |settings|' [=environment settings object/origin=].
+1. If |doc|'s [=Document/browsing context=] is a [=top-level browsing context=], return the [=partitioned storage key=] (|site|, |site|).
 1. Let |top-level site| be the result of [=obtain a site|obtaining a site=] from |settings|' [=top-level origin=].
-1. Let |key| be the [=pair=] |top-level site|/|site|.
-1. Let |flags| be null.
-1. If [=storage access map=][|key|] [=exists=], set |flags| to [=storage access map=][|key|].
-1. If |flags| is null, run these steps:
-    1. Set |flags| to be a new [=storage access flag set=].
-    1. [=Set=] [=storage access map=][|key|] to |flags|.
-1. Return |flags|.
+1. Return the [=partitioned storage key=] (|top-level site|, |site|).
+
+A <dfn>storage access flag set</dfn> is a set of zero or more of the following flags, which are used to gate access to client-side storage for |embedded site| when loaded in a [=third party context=] on |top-level site|:
+
+: The <dfn for="storage access flag set" id=has-storage-access-flag>has storage access flag</dfn>
+:: When set, this flag indicates |embedded site| has access to its [=first party data=] when it's loaded in a [=third party context=] on |top-level site|.
+: The <dfn for="storage access flag set" id=was-expressly-denied-storage-access-flag>was expressly denied storage access flag</dfn>
+:: When set, this flag indicates that the user expressly denied |embedded site| access to its [=first party data=] when it's loaded in a [=third party context=] on |top-level site|.
+
+To <dfn type="abstract-op">obtain a storage access flag set</dfn> for a [=partitioned storage key=] |key| from a [=/storage access map=] |map|, run the following steps:
+
+1. If |map|[|key|] [=map/exists|does not exist=], run these steps:
+    1. Let |flags| be a new [=storage access flag set=].
+    1. [=map/Set=] |map|[|key|] to |flags|.
+1. Return |map|[|key|].
+
+To <dfn type="abstract-op">save the storage access flag set</dfn> for a [=partitioned storage key=] |key| in a [=/storage access map=] |map|, run the following steps:
+
+1. [=map/Set=] [=global storage access map=][|key|] to |map|[|key|].
 
 <h3 id="the-document-object">Changes to {{Document}}</h3>
 
@@ -129,13 +157,17 @@ When invoked on {{Document}} |doc|, the <dfn export method for=Document><code>ha
 <!-- https://hg.mozilla.org/mozilla-central/file/tip/dom/base/Document.cpp#l15512 -->
 
 1. Let |p| be [=a new promise=].
-1. Let |flag set| be the result of [=obtain the storage access flag set|obtaining the storage access flag set=] of |doc|.
-1. If |flag set|'s [=was expressly denied storage access flag=] is set, [=resolve=] |p| with false and return |p|. <!-- WebKit's DocumentStorageAccess.cpp#L85 -->
-1. If |doc|'s [=Document/origin=] is an [=opaque origin=], [=resolve=] |p| with false and return |p|. <!-- WebKit's DocumentStorageAccess.cpp#L90 --> <!-- Gecko's Document.cpp#l15526 -->
-1. If |doc|'s [=Document/browsing context=] is a [=top-level browsing context=], [=resolve=] |p| with true and return |p|. <!-- WebKit's DocumentStorageAccess.cpp#L95 --> <!-- Gecko's Document.cpp#l15531 -->
+1. Let |map| be the result of [=obtain the storage access map|obtaining the storage access map=] for |doc|.
+1. Let |key| be the result of [=generate a partitioned storage key|generating a partitioned storage key=] from |doc|.
+1. If |key| is failure, then [=/resolve=] |p| with false and return |p|.
+1. Let |flag set| be the result of [=obtain a storage access flag set|obtaining the storage access flag set=] with |key| from |map|.
+1. If |flag set|'s [=was expressly denied storage access flag=] is set, [=/resolve=] |p| with false and return |p|. <!-- WebKit's DocumentStorageAccess.cpp#L85 -->
+1. If |doc|'s [=Document/origin=] is an [=opaque origin=], [=/resolve=] |p| with false and return |p|. <!-- WebKit's DocumentStorageAccess.cpp#L90 --> <!-- Gecko's Document.cpp#l15526 -->
+1. If |doc|'s [=Document/browsing context=] is a [=top-level browsing context=], [=/resolve=] |p| with true and return |p|. <!-- WebKit's DocumentStorageAccess.cpp#L95 --> <!-- Gecko's Document.cpp#l15531 -->
 1. Let |topDoc| be the [=active document=] of |doc|'s [=Document/browsing context=]'s [=top-level browsing context=].
-1. If |doc| is [=same origin=] with |topDoc|, [=resolve=] |p| with true and return |p|. <!-- WebKit's DocumentStorageAccess.cpp#L102 --> <!-- Gecko's Document.cpp#l15541 -->
-1. Resolve |p| with the result of running [=determine if a document has storage access=] with |doc| and |topDoc|. <!-- WebKit's DocumentStorageAccess.cpp#L115 --> <!-- Gecko's Document.cpp#l15548 -->
+1. If |doc| is [=same origin=] with |topDoc|, [=/resolve=] |p| with true and return |p|. <!-- WebKit's DocumentStorageAccess.cpp#L102 --> <!-- Gecko's Document.cpp#l15541 -->
+1. Let |key| be the result of [=generate a partitioned storage key|generating a partitioned storage key=] from |doc|.
+1. [=/Resolve=] |p| with the result of running [=determine if a site has storage access=] with |key| and |doc|. <!-- WebKit's DocumentStorageAccess.cpp#L115 --> <!-- Gecko's Document.cpp#l15548 -->
 1. Return |p|.
 
 ISSUE: Shouldn't step 7 be [=same site=]?
@@ -149,18 +181,23 @@ When invoked on {{Document}} |doc|, the <dfn export method for=Document><code>re
 1. Let |storage access request queue| be the result of [=starting a new parallel queue=].
 1. Let |p| be [=a new promise=].
 1. [=Enqueue the following steps=] to |storage access request queue|:
-    1. Let |flag set| be the result of [=obtain the storage access flag set|obtaining the storage access flag set=] of |doc|.
+    1. Let |map| be the result of [=obtain the storage access map|obtaining the storage access map=] for |doc|.
+    1. Let |key| be the result of [=generate a partitioned storage key|generating a partitioned storage key=] from |doc|.
+    1. If |key| is failure, [=reject=] |p|.
+    1. Let |flag set| be the result of [=obtain a storage access flag set|obtaining the storage access flag set=] with |key| from |map|.
     1. If |flag set|'s [=was expressly denied storage access flag=] is set, [=reject=] |p|.
-    1. If |flag set|'s [=has storage access flag=] is set, [=resolve=] |p|. <!-- WebKit's DocumentStorageAccess.cpp#L128 --> <!-- Gecko's Document.cpp#l15604 -->
+    1. If |flag set|'s [=has storage access flag=] is set, [=/resolve=] |p|. <!-- WebKit's DocumentStorageAccess.cpp#L128 --> <!-- Gecko's Document.cpp#l15604 -->
     1. If |doc|'s [=Document/origin=] is an [=opaque origin=], [=reject=] |p|. <!-- WebKit's DocumentStorageAccess.cpp#L133 --> <!-- Gecko's Document.cpp#l15618 -->
-    1. If |doc|'s [=Document/browsing context=] is a [=top-level browsing context=], [=resolve=] |p|. <!-- WebKit's DocumentStorageAccess.cpp#L138 --> <!-- Gecko's Document.cpp#l15632 -->
+    1. If |doc|'s [=Document/browsing context=] is a [=top-level browsing context=], [=/resolve=] |p|. <!-- WebKit's DocumentStorageAccess.cpp#L138 --> <!-- Gecko's Document.cpp#l15632 -->
     1. Let |topDoc| be the [=active document=] of |doc|'s [=Document/browsing context=]'s [=top-level browsing context=].
-    1. If |doc| is [=same origin=] with |topDoc|, [=resolve=] |p|. <!-- WebKit's DocumentStorageAccess.cpp#L146 --> <!-- Gecko's Document.cpp#l15604 --> <!-- Gecko's Document.cpp#l15657 -->
+    1. If |doc| is [=same origin=] with |topDoc|, [=/resolve=] |p|. <!-- WebKit's DocumentStorageAccess.cpp#L146 --> <!-- Gecko's Document.cpp#l15604 --> <!-- Gecko's Document.cpp#l15657 -->
     1. If |doc|'s [=active sandboxing flag set=] has its [=sandbox storage access by user activation flag=] set, [=reject=] |p|. <!-- WebKit's DocumentStorageAccess.cpp#L152 --> <!-- Gecko's Document.cpp#l15667 -->
     1. If |doc|'s [=Document/browsing context=]'s [=opener browsing context=] is not its [=top-level browsing context=], [=reject=] |p|. <!-- WebKit's DocumentStorageAccess.cpp#L158 --> <!-- Gecko's Document.cpp#l15673 -->
     1. If this algorithm was invoked when |doc|'s {{Window}} object did not have [=transient activation=], [=reject=] |p|. <!-- WebKit's DocumentStorageAccess.cpp#L163 --> <!-- Gecko's Document.cpp#l15680 -->
-    1. [=Determine the storage access policy=] with |doc|, |topDoc|, and |p|. <!-- WebKit's DocumentStorageAccess.cpp#L177 --> <!-- Gecko's Document.cpp#l15685 -->
-    1. Set |flag set|'s [=has storage access flag=], [=resolve=] |p|. <!-- Gecko's Document.cpp#l15805 -->
+    1. [=Determine the storage access policy=] with |key|, |doc|, and |p|. <!-- WebKit's DocumentStorageAccess.cpp#L177 --> <!-- Gecko's Document.cpp#l15685 -->
+    1. Set |flag set|'s [=has storage access flag=].
+    1. [=Save the storage access flag set=] for |key| in |map|.
+    1. [=/Resolve=] |p|. <!-- Gecko's Document.cpp#l15805 -->
 1. Return |p|.
 
 ISSUE: Shouldn't step 3.7 be [=same site=]?
@@ -169,31 +206,40 @@ ISSUE(10): Remove step 3.9 if we determine that nested <{iframe}>s should be abl
 
 <h4 id="ua-policy">User Agent storage access policies</h4>
 
-Different User Agents have different policies around whether or not [=third parties=] may access their [=first party data=]. User Agents check and/or modify these policies when client-side storage is accessed (see [[#storage]]) as well as when {{Document/hasStorageAccess()}} and {{Document/requestStorageAccess()}} are called.
+Different User Agents have different policies around whether or not [=sites=] may access their [=first party data=] when they're in a [=third party context=]. User Agents check and/or modify these policies when client-side storage is accessed (see [[#storage]]) as well as when {{Document/hasStorageAccess()}} and {{Document/requestStorageAccess()}} are called.
 
-To <dfn type="abstract-op">determine if a document has storage access</dfn> with {{Document|Documents}} |doc| and |topDoc|, run these steps:
+To <dfn type="abstract-op">determine if a site has storage access</dfn> with [=partitioned storage key=] |key| and {{Document}} |doc|, run these steps:
 
-1. Assert: |topDoc| is the [=active document=] of |doc|'s [=Document/browsing context=]'s [=top-level browsing context=].
-1. Let |flag set| be the result of [=obtain the storage access flag set|obtaining the storage access flag set=] of |doc|.
+1. Let |map| be the result of [=obtain the storage access map|obtaining the storage access map=] for |doc|.
+1. Let |flag set| be the result of [=obtain a storage access flag set|obtaining the storage access flag set=] with |key| from |map|.
 1. If |flag set|'s [=has storage access flag=] is set, return true.
-1. Let |has storage access| (a [=boolean=]) be the result of running a UA-defined set of steps to determine if |doc| (a [=third party=] in |topDoc|) has access to its [=first party data=].
+1. Let |has storage access| (a [=boolean=]) be the result of running an [=implementation-defined=] set of steps to determine if |key|'s [=partitioned storage key/embedded site=] has access to its [=first party data=] on |key|'s [=partitioned storage key/top-level site=].
 1. If |has storage access| is true, set |flag set|'s [=has storage access flag=].
+1. [=Save the storage access flag set=] for |key| in |map|.
 1. Return |has storage access|.
 
-To <dfn type="abstract-op">determine the storage access policy</dfn> for {{Document|Documents}} |doc| and |topDoc| with {{Promise}} |p|, run these steps:
+To <dfn type="abstract-op">determine the storage access policy</dfn> for [=partitioned storage key=] |key| with {{Document}} |doc| and {{Promise}} |p|, run these steps:
+
+1. Let |map| be the result of [=obtain the storage access map|obtaining the storage access map=] for |doc|.
+1. Let |flag set| be the result of [=obtain a storage access flag set|obtaining the storage access flag set=] with |key| from |map|.
+1. Let |implicitly granted| and |implicitly denied| (each a [=boolean=]) be the result of running an [=implementation-defined=] set of steps to determine if |key|'s [=partitioned storage key/embedded site=]'s request for storage access on |key|'s [=partitioned storage key/top-level site=] should be granted or denied without prompting the user.
+
+    Note: These [=implementation-defined=] set of steps might result in |flag set|'s [=has storage access flag=] and [=was expressly denied storage access flag=] changing, since the User Agent could have relevant out-of-band information (e.g. a user preference that changed) that this specification is unaware of.
+1. If |implicitly granted| is true, [=/resolve=] |p| and return.
+1. If |implicitly denied| is true, [=/reject=] |p| and return.
+1. Ask the user if they would like to grant |key|'s [=partitioned storage key/embedded site=] access to its [=first party data=] when it's loaded in a [=third party context=] on |key|'s [=partitioned storage key/top-level site=], and wait for an answer. Let |expressly granted| and |expressly denied| (both [=booleans=]) be the result.
 
-1. Assert: |topDoc| is the [=active document=] of |doc|'s [=Document/browsing context=]'s [=top-level browsing context=].
-1. Let |implicitly granted| and |implicitly denied| (each a [=boolean=]) be the result of running a UA-defined set of steps to determine if |doc|'s request for storage access on |topDoc| should be granted or denied without prompting the user.
-1. If |implicitly granted| is true, [=resolve=] |p| and return.
-1. If |implicitly denied| is true, [=reject=] |p| and return.
-1. Ask the user if they would like to grant |doc| access to its [=first party data=] when it is a [=third party=] on |topDoc|, and wait for an answer. Let |expressly granted| and |expressly denied| (both [=booleans=]) be the result.
-1. If |expressly granted| is true, [=resolve=] |p| and return. <!-- WebKit's DocumentStorageAccess.cpp#L191 -->
-1. Let |flag set| be the result of [=obtain the storage access flag set|obtaining the storage access flag set=] of |doc|.
+    Note: While |expressly granted| and |expressly denied| cannot both be true, they could both be false in User Agents which allow users to dismiss the prompt without choosing to allow or deny the request. (Such a dismissal is interpreted in this algorithm as a denial.)
+1. If |expressly granted| is true, run these steps:
+    1. Unset |flag set|'s [=was expressly denied storage access flag=].
+    1. [=Save the storage access flag set=] for |key| in |map|.
+    1. [=/Resolve=] |p| and return. <!-- WebKit's DocumentStorageAccess.cpp#L191 -->
 1. Unset |flag set|'s [=has storage access flag=].
 1. If |expressly denied| is true, run these steps:
     1. If |doc|'s {{Window}} object has [=transient activation=], [=consume user activation=] with it. <!-- WebKit's DocumentStorageAccess.cpp#L181 -->
     1. Set |flag set|'s [=was expressly denied storage access flag=].
-1. [=Reject=] |p| and return. <!-- WebKit's DocumentStorageAccess.cpp#L194 --> <!-- Gecko's Document.cpp#l15805 -->
+1. [=Save the storage access flag set=] for |key| in |map|.
+1. [=/Reject=] |p| and return. <!-- WebKit's DocumentStorageAccess.cpp#L194 --> <!-- Gecko's Document.cpp#l15805 -->
 
 ISSUE: [since this is UA-defined, does it make sense to follow-up separately with a user prompt?](https://github.com/privacycg/storage-access/pull/24#discussion_r408784492)
 
@@ -201,14 +247,19 @@ ISSUE: [since this is UA-defined, does it make sense to follow-up separately wit
 
 Before changing the [=current entry=] of a [=session history=], run the following steps:
 
-1. Let |flag set| be the result of [=obtain the storage access flag set|obtaining the storage access flag set=] of [=current entry=]'s {{Document}}.
+1. Let |doc| be [=current entry=]'s {{Document}}.
+1. Let |map| be the result of [=obtain the storage access map|obtaining the storage access map=] for |doc|'s [=Document/browsing context=]'s [=top-level browsing context=].
+1. Let |key| be the result of [=generate a partitioned storage key|generating a partitioned storage key=] from |doc|.
+1. If |key| is failure, abort these steps.
+1. Let |flag set| be the result of [=obtain a storage access flag set|obtaining the storage access flag set=] with |key| from |map|.
 1. Unset |flag set|'s [=has storage access flag=].
+1. [=Save the storage access flag set=] for |key| in |map|.
 
 ISSUE(3): What this section should look like ultimately hinges on
 
 <h3 id="storage">Changes to various client-side storage mechanisms</h3>
 
-ISSUE: Write this section. For each kind of client-side storage affected, modify them to invoke [=determine if a document has storage access=] & modify their behavior based on the result.
+ISSUE: Write this section. For each kind of client-side storage affected, modify them to invoke [=determine if a site has storage access=] & modify their behavior based on the result.
 
 ISSUE(4): Should this API affect client-side storage other than cookies?