For permissions that control access to a resource managed by the Browser (eg: system level features like clipboard), we should check the permission as close as possible to the resource usage.

This means checking the permission in the Browser process (in addition to or instead of the Renderer process).

Comment from dcheng@ (in https://chromium-review.googlesource.com/c/chromium/src/+/804973/1)
"""
Unfortunately, I think being able to do this is going to be some ways off. Today, the clipboard IPCs are not frame-scoped, so a compromised renderer could simply bypass the permissions checks altogether and just invoke the clipboard IPCs directly.

Fixing that would be a worthwhile followup once slangley@ is done simplifying clipboard.mojom. However, even then, there's another problem: edit commands are handled by the renderer, so it's the renderer that essentially initiates the request for pasting. So we would need to change this to be browser-driven as well and push the data from the browser down into the renderer on a paste, rather than the renderer going back up to the browser when it realizes it needs to do a paste. That would be a fairly involved change as well... so I think this is the best we can do for now.
"""