diff --git a/index.bs b/index.bs
index 9349d0aa2c..d7ba126a56 100644
--- a/index.bs
+++ b/index.bs
@@ -3800,6 +3800,11 @@ Content-Type: application/reports+json
Given a request |request|, a response |response|,
a directive |directive|, and a policy |policy|:
+ Note: This check needs both |request| and |response| as input
+ parameters since if |request|'s cryptographic nonce metadata
+ or integrity metadata matches, then the script is allowed to load
+ and the check of whether |response|'s url matches the source list is skipped.
+
1. If |request|'s destination is script-like:
1. Call [=potentially report hash=] with |response|, |request|, |directive| and |policy|.
@@ -3814,13 +3819,17 @@ Content-Type: application/reports+json
for="request">integrity metadata and this directive's value is "`Matches`", return "`Allowed`".
- 1. If |directive|'s value contains
- "`'strict-dynamic'`":
+ 1. If |directive|'s value contains a source
+ expression that is an ASCII case-insensitive match for
+ the "`'strict-dynamic'`" keyword-source:
- 1. If |request|'s parser metadata is not
- "parser-inserted", return "`Allowed`".
+ 1. If the |request|'s parser metadata is
+ "parser-inserted", return "`Blocked`".
- Otherwise, return "`Blocked`".
+ Otherwise, return "`Allowed`".
+
+ Note: "`'strict-dynamic'`" is explained in more detail
+ in [[#strict-dynamic-usage]].
1. If the result of executing [[#match-response-to-source-list]] on
|response|, |request|, |directive|'s value,