This is a feature request to give developers more options to configure the allow attribute for iframes generated by HtmlService.
The immediate use case is to enable on-device AI capabilities like Gemini Nano, which requires the host iframe to include the allow="language-model" attribute to grant access to the Prompt API, as outlined in recent Chrome AI announcements. Without this, it's currently impossible to build Workspace Add-ons that leverage these new browser features.
Currently, add-on iframes are served with an extensive list of permissions (e.g., camera, geolocation, microphone), which demonstrates that a permissions framework is already in place. To provide developers with control, we suggest a new method for the HtmlOutput class, such as .setIframeAllow(permissionString). This new method could operate on a list of Google-approved permission strings, ensuring that only safe
