It's possible to invoke methods on objects in windows with no longer fully-active documents, because DOM. Generally, these are edge-cases with few if any use-cases other than exploits.

While individual specs are required to think about such cases, very few do.

This presents a unique problem for APIs exposing powerful features behind permissions, because we tie permissions to realms and origins. Specifically, we have to be careful about things like showing the right requesting origin in permission prompts, something that's only guaranteed to make sense from documents that are still fully active.

As an extra safeguard, would it make sense to add prose to the request permission to use algorithm to return "denied" if the responsible document is no longer fully active?

This would expressly forbid powerful features in these edge cases. I can't think of a case where doing so would be a problem.

@jyasskin Thoughts?