Isolation you cannot deploy alone
The page needs shared memory, which the browser only hands to a document that has proved it is cross-origin isolated. The two headers went on, and three of the things the page loads stopped loading.
The embedder policy is not a statement about your own resources. It is a demand you place on everything you embed — and one of the three is an iframe from a vendor who will never set a header for you.
Boundaries, outermost first: Not yours to fix: Vendor's iframe (sets no headers at all; FAILED: you cannot fix it), Vendor script host (fetched in no-cors mode; FAILED: no CORP header) Outside every boundary: Your asset host (a subdomain you own), Your document (needs shared memory), Embedder policy (require-corp, deployed), an empty slot for the the opener policy value, an empty slot for the what a host you own sends, an empty slot for the how this one is asked for Connections: the opener policy value controls Your document — condition one (step 1) Embedder policy controls Your document — condition two (step 2) Your document calls what a host you own sends (step 3) what a host you own sends calls Your asset host — declares a policy Your document calls how this one is asked for (step 4) how this one is asked for calls Vendor script host — cors, not no-cors Your document must NOT reach Vendor's iframe — no lever on this one