Be more precise than "high trust"

[jyasskin]

It's not clear what the explainer means by "the applications with the highest degree of trust". That could cover cases where the user has thought really hard about a particular application and decided to trust it, or that the browser-maker has manually reviewed the application, or, as I think you mean here, that the device owner or administrator has explicitly enabled the application through enterprise policy or an equivalent mechanism.

You could instead talk about origins for which device policy has explicitly enabled these APIs. Then we don't have to ask what other things the sites are trusted to do; they're just configured to be able to read this particular data.

[reillyeon]

The comment in #3 is similar. I think the explainer should be clear that supporting these APIs outside of a managed configuration is a non-goal, unless that isn't the case. I think that would make the trust model a lot clearer to reviewers.

[Ananubis]

Thanks for the suggestion. Two paragraphs ('What is this' and 'What are trusted applications') were changed to explicitly describe that these Web APIs are only available to managed devices. (I am not sure whether 'managed' is a commen concept which can be used directly.)

Please check the changes in this commit, and let me know if there is any further question. Thanks!

[slightlyoff]

I agree that we should, perhaps, move away from the specific language here and instead enunciate the full set of potential risks without claiming that any specific solution is ideal (or even required).

That said, having a non-normative "this is one way a UA could do it..." feels like something we absolutely want in an Explainer. Bonus points for multiple potential alternative treatments!

[sbykov-g]

I replaced 'trusted' with 'managed' throughout the explainer. Alex's comment is similar to #2 , so I'll address it there.