Add Permission Policy

explainer.md

@@ -56,6 +56,14 @@ Here is an example of how the  the API might be used in practice:
 ```
 You can read a more detailed and technical description of the API in the [specification draft](https://wicg.github.io/digital-identities/).
 
+### Using the API from another origin
+
+The specification allows usage of the API from a remote/third-party origin via the "digital-credentials-get" Permissions Policy. This is useful for scenarios where a website wants to request digital credentials from a wallet provider that is hosted on a different origin. The Permissions Policy can be set on an iframe that embeds the website that wants to use the API. Here is an example of how the Permissions Policy can be set on an iframe:
+
+```HTML
+<iframe allow="digital-credentials-get"></iframe>
+```
+
 ## Horizontal reviews
 
 * [Security and privacy TAG Questionnaire](horizontal-reviews/security-privacy.md)

index.html

@@ -309,6 +309,27 @@ <h3>
       <dfn class="export" data-dfn-for="DigitalCredential">[[\discovery]]</dfn>
       whose value is "remote".
     </p>
+    <section class="informative">
+      <h3>
+        User consent
+      </h3>
+      <p>
+        The <cite>Digital Credential API</cite> is a [=powerful feature=] that
+        requires [=express permission=] from an end-user. This requirement is
+        normatively enforced when calling {{CredentialsContainer}}'s
+        {{CredentialsContainer/get()}} method.
+      </p>
+    </section>
+    <section id="permissions-policy" data-cite="permissions-policy">
+      <h2>
+        Permissions Policy integration
+      </h2>
+      <p>
+        This specification defines a [=policy-controlled feature=] identified
+        by the string <dfn class="permission">"digital-credentials-get"</dfn>. 
+        Its [=policy-controlled feature/default allowlist=] is [=allowlist/'self'=].
+      </p>
+    </section>
     <h2 id="protocol-registry">
       Registry of protocols for requesting digital credential
     </h2>