Harmonize permissions and similar mechanisms

[plinss]

The web has several different apis currently available and in development for permissions and permission-adjacent items, such as gating access to features by user activation or similar mechanisms. There are also different mechanisms to hand-off permissions, and feature access privileges between iframes.

The TAG needs to take a look at consolidating these permissions into a single extensible model.

Related issues:
w3ctag/design-reviews#356
#347
w3ctag/design-reviews#225
w3ctag/design-reviews#203
w3ctag/design-reviews#199
w3ctag/design-reviews#159
w3ctag/design-reviews#45

[mikewest]

On this topic, I'd point y'all to https://www.w3.org/Privacy/permissions-ws-2018/papers/thomas-nattestad.pdf (and the permissions workshop position papers in general: https://www.w3.org/Privacy/permissions-ws-2018/papers.html).

[dbaron]

To what extent is this work that the TAG should do, versus work that the TAG should encourage others (who are hopefully more likely to be domain experts)?

[cynthia]

We discussed this during the Tokyo F2F, and one point that came up during the discussion is that we would like to see either the Permissions API get more traction as the first step of this work going forward, or an alternative if there is a better option. Regardless of what the mechanism is, the needs from a developer perspective are real and we think this should be addressed.

Another bit that came up was on how much the overlap between permissions and feature policy is - and whether or not the names match up.

[marcoscaceres]

We boiled it down to: "if you need a permission, and an iframe can use it, you need a feature policy."

[hadleybeeman]

Reviewed at our TAG face-to-face in Cupertino.

We want to take this forward, as a big chunk of work. We are moving it to the Design Principles repo, where we'll catch it at the right time.

[mikewest]

I believe there are folks in multiple organizations with various opinions and proposals in this space. What's a good way to get involved in y'all's musings on the topic?

[torgo]

Some suggestion on today's breakout that we could pull some principles directly out of the document that @mikewest linked above directly into the principles document.

[mikewest]

@torgo: Is that process something y'all would like help doing? Or would it be best to let y'all first produce something concrete that folks can express opinions about?

[torgo]

@mikewest we are just coming back to this now and trying to progress and yes, we'd be happy to have your help if you are still willing. Do you have some thoughts on this that you could write here?

[npdoty]

The 2018 workshop report and Adding another permission? a guide might also be useful sources on coming up with principles for harmonization of how we ask for permissions on the Web.

[hober]

Adding another permission? a guide might also be [a] useful source[…] on coming up with principles for harmonization of how we ask for permissions on the Web.

I think it would make sense for the Design Principles doc to reference or incorporate this guide. @npdoty, do you have advice? Is the guide an active PING document that we can reference?

[npdoty]

Adding another permission? a guide might also be [a] useful source[…] on coming up with principles for harmonization of how we ask for permissions on the Web.

I think it would make sense for the Design Principles doc to reference or incorporate this guide. @npdoty, do you have advice? Is the guide an active PING document that we can reference?

+1, I think it would be great to incorporate the adding-permissions guide into the Web Platform Design Principles document.

We can check with other PING folks about whether it makes sense to merge the whole permissions doc into design principles -- and PING can provide input on the Design Principles, or whether the design principles should just include a couple of the questions and cite a separately maintained document -- which PING can maintain if the TAG will also provide feedback during your discussions of the topic.

[torgo]

Thanks Nick! My thoughts are that it would be better to include a couple of the questions and then cite the PING document, but would be great to hear from other PING folks on this.

[npdoty]

Sounds good. Per PING call today, Christine will help us coordinate conversion to a Note and (with @hober maybe) get TAG review and updates of a couple questions for the design principles.