Update and clarify Permissions-Policy: geolocation

Author: bban160

files/en-us/web/http/reference/headers/permissions-policy/geolocation/index.md

@@ -21,10 +21,6 @@ Specifically, where a defined policy blocks use of this feature, calls to
 callbacks to be invoked with a {{domxref('GeolocationPositionError')}} code of
 `PERMISSION_DENIED`.
 
-By default, the Geolocation API can be used within top-level documents and their
-same-origin child frames. This directive allows or prevents cross-origin frames from
-accessing geolocation. This includes same-origin frames.
-
 ## Syntax
 
 ```http
@@ -36,40 +32,35 @@ Permissions-Policy: geolocation=<allowlist>;
 
 ## Default policy
 
-The default allowlist for `geolocation` is `self`.
+The default allowlist for `geolocation` is `self`. The top-level browsing context and same-origin iframes are allowed access to the `geolocation` feature by default.
 
 ## Examples
 
-### General example
+### Basic usage
 
-SecureCorp Inc. wants to disable the Geolocation API within all browsing contexts
-except for its own origin and those whose origin is `https://example.com`. It
-can do so by delivering the following HTTP response header to define a Permissions Policy:
+SecureCorp Inc. wants to disallow `geolocation` within all browsing contexts except for its own origin and those whose origin is `https://example.com`. It can do so by delivering the following HTTP response header to define a Permissions Policy:
 
 ```http
 Permissions-Policy: geolocation=(self "https://example.com")
 ```
 
-### With an \<iframe> element
-
-FastCorp Inc. wants to disable `geolocation` for all cross-origin child
-frames, except for a specific `<iframe>`. It can do so by delivering the following
-HTTP response header to define a Permissions Policy:
+Then include an {{HTMLElement('iframe','allow','#Attributes')}} attribute on the `<iframe>` element:
 
-```http
-Permissions-Policy: geolocation=(self)
+```html
+<iframe src="https://example.com/map" allow="geolocation"></iframe>
 ```
 
-Then include an {{HTMLElement('iframe','allow','#Attributes')}} attribute on the
-`<iframe>` element:
+> [!NOTE]
+> Specifying the `Permissions-Policy` header in this manner disallows `geolocation` for other origins, even if they would be allowed by the `<iframe>` `allow` attribute.
+
+### Using the default policy
+
+FastCorp Inc. wants to allow `geolocation` in a specific cross-origin child frame. Since the default allowlist for `geolocation` is `self`, it can do so by including an {{HTMLElement('iframe','allow','#Attributes')}} attribute on the `<iframe>` element:
 
 ```html
-<iframe src="https://other.com/map" allow="geolocation"></iframe>
+<iframe src="https://other.com/store-locator" allow="geolocation"></iframe>
 ```
 
-Interestingly, `allow` attributes can selectively enable features in certain frames, and not in others,
-even if those frames contain documents from the same origin.
-
 ## Specifications
 
 {{Specifications}}