This is a feature request to give developers more options to configure the allow
attribute for iframes generated by HtmlService
.
The immediate use case is to enable on-device AI capabilities like Gemini Nano, which requires the host iframe to include the allow="language-model"
attribute to grant access to the Prompt API, as outlined in recent Chrome AI announcements. Without this, it's currently impossible to build Workspace Add-ons that leverage these new browser features.
Currently, add-on iframes are served with an extensive list of permissions (e.g., camera
, geolocation
, microphone
), which demonstrates that a permissions framework is already in place. To provide developers with control, we suggest a new method for the HtmlOutput
class, such as .setIframeAllow(permissionString)
. This new method could operate on a list of Google-approved permission strings, ensuring that only safe