Add permissions policy section.

spec.bs

@@ -1880,6 +1880,9 @@ On the other hand, methods for getting data from the [=shared storage database=]
     1. Let |context| be null.
     1. If |globalObject| is a {{Window}}:
         1. Set |context| to |globalObject|'s [=Window/browsing context=].
+        1. Let |document| be |context|'s [=active document=].
+        1. Let |origin| be |globalObject|'s [=relevant settings object=]'s [=environment settings object/origin=].
+        1. If the result of running [=Is feature enabled in document for origin?=] on "[=PermissionsPolicy/fenced-unpartitioned-storage-read=]", |document|, and |origin| is false, [=reject=] |promise| with an {{OperationError}}.
         1. Let |navigable| be |globalObject|'s [=Window/navigable=].
         1. If the result of [=determining if a navigable has fully revoked network=] given |navigable| is false, [=reject=] |promise| with an {{OperationError}}.
     1. Else:
@@ -2392,9 +2395,14 @@ The [=obtain a lock manager=] algorithm should be prepended with the following s
 Permissions Policy Integration {#permission}
 ============================================
 
-This specification defines a [=policy-controlled feature=] identified by the string "<dfn for="PermissionsPolicy">shared-storage</dfn>," along with a second [=policy-controlled feature=] identified by "<dfn for="PermissionsPolicy">shared-storage-select-url</dfn>".
+This specification defines three [=policy-controlled features=]:
 
-"[=PermissionsPolicy/shared-storage=]" gates access to Shared Storage in general, whereas "[=shared-storage-select-url=]" adds an extra permission layer to {{SharedStorageWorklet/selectURL()}}. For each of these, the default allowlist is *.
+1. "<dfn for="PermissionsPolicy">shared-storage</dfn>" gates access to Shared Storage in general.
+1. "<dfn for="PermissionsPolicy">shared-storage-select-url</dfn>" adds an extra permission layer to {{SharedStorageWorklet/selectURL()}}
+1. "<dfn for="PermissionsPolicy">fenced-unpartitioned-storage-read</dfn>" adds an extra permission layer to {{SharedStorage/get()}}, to
+ensure it can only be invoked successfully from a {{Window}} if the {{Promise}} returned from {{Fence/disableUntrustedNetwork()}} has [=resolved=].
+
+For each of these, the default allowlist is *.
 
 Clear Site Data Integration {#clear}
 ====================================