diff --git a/index.html b/index.html
index 3ece9da..09d6fb0 100644
--- a/index.html
+++ b/index.html
@@ -393,8 +393,14 @@ <h2>
       </pre>
       <dl>
         <dt>
-          <dfn>getGamepads</dfn>
+          <dfn>getGamepads()</dfn>
         </dt>
+        <dd>
+          If the <a>current settings object</a>'s [=environment settings object
+          / responsible document=] is not <a>allowed to use</a> the "`gamepad`"
+          permission, then [=exception/throw=] a {{"SecurityError"}}
+          {{DOMException}}.
+        </dd>
         <dd>
           Retrieve a snapshot of the data for the the currently connected and
           interacted-with gamepads. Gamepads MUST only appear in the list if
@@ -733,10 +739,10 @@ <h3 id="event-gamepadconnected">
       <p>
         User agents implementing this specification must provide a new DOM
         event, named <code>gamepadconnected</code>. The corresponding event
-        MUST be of type <code>GamepadEvent</code> and MUST fire on the
-        <code>window</code> object. Registration for and firing of the
-        <code>gamepadconnected</code> event MUST follow the usual behavior of
-        DOM Events. [[DOM]]
+        MUST be of type {{GamepadEvent}} and, if <a>allowed to use</a> the
+        "`gamepad`" permission, MUST fire on the <code>window</code> object.
+        Registration for and firing of the <code>gamepadconnected</code> event
+        MUST follow the usual behavior of DOM Events. [[DOM]]
       </p>
       <p>
         A <a>user agent</a> MUST dispatch this event type to indicate the user
@@ -752,8 +758,9 @@ <h3 id="event-gamepaddisconnected">
       <p>
         User agents implementing this specification must provide a new DOM
         event, named <code>gamepaddisconnected</code>. The corresponding event
-        MUST be of type <code>GamepadEvent</code> and MUST fire on the
-        <code>window</code> object. Registration for and firing of the
+        MUST be of type <code>GamepadEvent</code> and, if <a>allowed to use</a>
+        the "`gamepad`" permission, MUST fire on the <code>window</code>
+        object. Registration for and firing of the
         <code>gamepaddisconnected</code> event MUST follow the usual behavior
         of DOM Events. [[DOM]]
       </p>
@@ -776,6 +783,25 @@ <h3>
         button.</i>
       </p>
     </section>
+    <section id="permission-policy" data-cite="Feature-Policy">
+      <h2>
+        Integration with Permissions Policy
+      </h2>
+      <p>
+        This specification defines a policy-controlled feature identified by
+        the string "`gamepad`". Its <a>default allowlist</a> is '`self`'.
+      </p>
+      <div class="note">
+        <p>
+          A <a>document</a>’s [=Document/permissions policy=] determines
+          whether any content in that document is allowed to access
+          {{Navigator/getGamepads()}}. If disabled in any document, no content
+          in the document will be <a>allowed to use</a>
+          {{Navigator/getGamepads()}}, nor will the "gamepadconnected" and
+          "gamepaddisconnected" events fire.
+        </p>
+      </div>
+    </section>
     <section id='conformance'>
       <p>
         This specification defines conformance criteria that apply to a single