From 3ec2711ce45d9b558bc67f0903fbce9bbb244871 Mon Sep 17 00:00:00 2001
From: Daksh <24bee040@nith.ac.in>
Date: Fri, 23 Oct 2026 02:54:36 +0530
Subject: [PATCH] spec: separate allow attribute features with '; ' and include
 clipboard-write

The security section built the iframe allow attribute with allowList.join(' ').
Permissions Policy separates features with ';', so allow="camera microphone" is
parsed as camera with an invalid allowlist and grants neither. The SDK's
buildAllowAttribute() already joins with '; ' and maps clipboardWrite, so this
aligns the stable and draft spec examples with the implementation.
---
 specification/2026-01-26/apps.mdx | 4 +++-
 specification/draft/apps.mdx      | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/specification/2026-01-26/apps.mdx b/specification/2026-01-26/apps.mdx
index 43fef209d..3a811206d 100644
--- a/specification/2026-01-26/apps.mdx
+++ b/specification/2026-01-26/apps.mdx
@@ -1748,7 +1748,9 @@ const allowList: string[] = [];
 if (permissions?.camera) allowList.push('camera');
 if (permissions?.microphone) allowList.push('microphone');
 if (permissions?.geolocation) allowList.push('geolocation');
-const allowAttribute = allowList.join(' ');
+if (permissions?.clipboardWrite) allowList.push('clipboard-write');
+// Permissions Policy directives are separated by ';' (a space would start an allowlist)
+const allowAttribute = allowList.join('; ');
 ```
 
 **Security Requirements:**
diff --git a/specification/draft/apps.mdx b/specification/draft/apps.mdx
index f2523f25e..f043f7141 100644
--- a/specification/draft/apps.mdx
+++ b/specification/draft/apps.mdx
@@ -2557,7 +2557,9 @@ const allowList: string[] = [];
 if (permissions?.camera) allowList.push('camera');
 if (permissions?.microphone) allowList.push('microphone');
 if (permissions?.geolocation) allowList.push('geolocation');
-const allowAttribute = allowList.join(' ');
+if (permissions?.clipboardWrite) allowList.push('clipboard-write');
+// Permissions Policy directives are separated by ';' (a space would start an allowlist)
+const allowAttribute = allowList.join('; ');
 ```
 
 **Security Requirements:**