It's a draft W3C web security standard, defining an HTTP header and iframe attribute that sets limits on the browser features a page can use. More recently that's lead to the start of real production usage: Rails 6.1opens in a new tab and Node.js's popular helmetopens in a new tab security package recently shipped built-in support, and Scott Helme's latest analysisopens in a new tab of the top 1 million sites shows the Feature-Policy header in use by nearly 5,000 of them. Many proposed additions don't mesh with the existing Feature-Policy behaviour, so these (along with some of the existing features) are being defined instead in a new Document-Policy opens in a new tab header, with different semantics focused on feature configuration, rather than security.