Integrate with Feature Policy

index.html

@@ -617,13 +617,11 @@ 
           act as follows:
         
         
-          
-          "allowpaymentrequest/active-document-cross-origin.https.sub.html, allowpaymentrequest/active-document-same-origin.https.html, allowpaymentrequest/removing-allowpaymentrequest.https.sub.html, allowpaymentrequest/setting-allowpaymentrequest-timing.https.sub.html, allowpaymentrequest/setting-allowpaymentrequest.https.sub.html">
-          If the current settings object's 
+          If the current settings object's 
           "HTML#responsible-document">responsible document is not
-          allowed to use the feature indicated by attribute name
-          allowpaymentrequest, then throw a
-          "SecurityError" DOMException.
+          allowed to use the "payment"
+          feature, then throw a "SecurityError"
+          DOMException.
           
           Let serializedMethodData be an empty list.
           
@@ -3475,12 +3473,49 @@ 
       
         PaymentRequest and iframe elements
       
-      
-      "allowpaymentrequest/active-document-cross-origin.https.sub.html, allowpaymentrequest/active-document-same-origin.https.html, allowpaymentrequest/allowpaymentrequest-attribute-cross-origin-bc-containers.https.html, allowpaymentrequest/allowpaymentrequest-attribute-same-origin-bc-containers.https.html, allowpaymentrequest/basic.https.html, allowpaymentrequest/no-attribute-cross-origin-bc-containers.https.html, allowpaymentrequest/no-attribute-same-origin-bc-containers.https.html, allowpaymentrequest/removing-allowpaymentrequest.https.sub.html, allowpaymentrequest/setting-allowpaymentrequest-timing.https.sub.html, allowpaymentrequest/setting-allowpaymentrequest.https.sub.html">
+      
         To indicate that a cross-origin iframe is allowed to invoke the
         payment request API, the allowpaymentrequest attribute can be
-        specified on the iframe element.
+        specified on the iframe element. See 
+        "#feature-policy"> for details of how allowpaymentrequest
+        and Feature Policy interact.
+      
+    
+    
+      
+        Feature Policy integration
+      
+      
+        This specification defines a policy-controlled feature identified by
+        the string "
+        "">payment". Its 
+        "feature-policy#default-allowlist">default allowlist is
+        'self'.
       
+      
+        
+          A document’s 
+          "html/multipage/dom.html#concept-document-feature-policy">feature
+          policy determines whether any content in that document is allowed
+          to construct PaymentRequest instances. If disabled in any
+          document, no content in the document will be allowed to use
+          the PaymentRequest constructor (trying to create an instance
+          will throw).
+        
+        
+          The allowpaymentrequest attribute of the HTML iframe
+          element affects the 
+          "feature-policy#container-policy">container policy for any
+          document nested in that iframe. Unless overridden by the
+          
+          "html/multipage/iframe-embed-object.html#attr-iframe-allow">allow
+          attribute, setting allowpaymentrequest on an iframe is
+          equivalent to <iframe allow="fullscreen *">, as
+          described in 
+          "feature-policy#iframe-allowpaymentrequest-attribute">Feature Policy
+          §iframe-allowpaymentrequest-attribute.
+        
+