caption: Allows origin-keyed agent clustering by default.
default: true
desc: |-
  This policy allows origin-keyed agent clustering by default.

  The Origin-Agent-Cluster HTTP header controls whether a document is
  isolated in an origin-keyed agent cluster, or in a site-keyed agent
  cluster. This has security implications since an origin-keyed agent
  cluster allows isolating documents by origin. The developer-visible
  consequence of this is that the document.domain accessor can no longer
  be set.

  The default behaviour - when no Origin-Agent-Cluster header has been set -
  changes in M111 from site-keyed to origin-keyed.

  If this policy is enabled or not set, the browser will follow this
  new default from that version on.

  If this policy is disabled this change is reversed and
  documents without Origin-Agent-Cluster headers will be assigned to
  site-keyed agent clusters. As a consequence, the document.domain accessor
  remains settable by default. This matches the legacy behaviour.

  See https://developer.chrome.com/blog/immutable-document-domain/ for
  additional details.
example_value: false
features:
  dynamic_refresh: true
  per_profile: true
future_on:
- fuchsia
items:
- caption: By default, documents may be put in origin-keyed agent clusters. document.domain
    is not settable for such documents.
  value: true
- caption: By default, documents are put in site-keyed agent clusters. document.domain
    remains settable.
  value: false
owners:
- vogelheim@chromium.org
- chrome-security-owp-team@google.com
schema:
  type: boolean
supported_on:
- chrome.*:100-
- chrome_os:100-
tags: []
type: main
