So what I've been wondering about (see also #32) is if we can do this as part of "obtain a connection", before returning a connection to the caller. And returning failure if the check fails. It seems that would be the most principled solution.

So WebRTC doesn’t use the same “obtain a connection” step, so if the goal is #32 , that may not work sufficiently for that case, although it may for this specific issue.

That said, I’m not sure I follow the “principled” remark. There’s a host of surprising edge cases either way, so I don’t think it necessarily improves predictability for developers. There is something to be said about the simplicity of the current approach, but just needing to call out the logical consequences explicitly for developers who may not have thought through the implications.

It doesn't yet, but it probably should: w3c/webrtc-extensions#73. We keep running into policy mismatches and such.

Above commit adds this warning to the spec. Remaining: add it to the explainer also.