Should this be integrated with the permissions API?

[rayankans]

This will give UAs more flexibility on how they want to enable the API.

This might also enable some interesting cases like #11, where iframes can use the API, after users give their permission.

[slightlyoff]

Would perhaps be worth thinking through Feature Policy and permission delegation integration at the same time. I expect we can re-use existing patterns for all of this.