The silent grant that is about to start prompting
The product spans several domains that belong to the same organisation. The cross-domain flow was built on a declared set of related sites, so the browser handed the embed access to its own cookies without asking anyone. That was the sanctioned answer, and it came from the browser vendor.
The set mechanism is being withdrawn. When it goes, the same flow falls back to the ordinary behaviour: a permission prompt, shown to every user, in the middle of a journey designed on the assumption that nothing would ever be shown.
Boundaries, outermost first: The embed: Embedded widget (a different site), an empty slot for the state the embed owns, an empty slot for the what precedes the ask, an empty slot for the who asks, and from where Top-level site: Top-level page (your own domain) Outside every boundary: User, The declared set (being withdrawn; FAILED: no longer grants) Connections: User calls Top-level page (step 1) Top-level page calls Embedded widget — loads the embed (step 2) state the embed owns controls Embedded widget The declared set must NOT reach Embedded widget — no longer grants User calls what precedes the ask — a real click (step 3) what precedes the ask calls who asks, and from where (step 4) who asks, and from where calls Embedded widget — access granted (step 5)