Browsers expose powerful features to web pages. Permissions-Policy lets you declare up front which of them your site uses. A feature you turn off cannot be used by any script on the page, including a third-party script or an injected one, and embedded frames cannot ask for it either.
Each feature is given an allow list. An empty list, written as (), disables the feature everywhere. The value self allows your own origin only, and you can name specific outside origins that need access, such as a video call provider. For iframes, the allow attribute on the iframe element works together with the header to decide what embedded content may do.
This is a damage-limiting control. If an attacker manages to run a script on your page, a restrictive policy stops that script from quietly requesting the camera or location under your site's name. The header was previously called Feature-Policy, and the list of supported features varies between browsers, so treat it as one layer among several.
Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()