PublicKeyCredential.getClientCapabilities() - clarify required permission

[hamishwillee]

PublicKeyCredential.getClientCapabilities() spec says:

Note: Invoking this method from a browsing context where the Web Authentication API is "disabled" according to the allowed to use algorithm—i.e., by a permissions policy—will result in the promise being rejected with a DOMException whose name is "NotAllowedError". See also § 5.9 Permissions Policy integration.

However the API is gated by two permissions, and they are quite specific to either creation or fetching credentials. Can you clarify whether it is one permission or both that gates access to this method?

This is for MDN docs for the method mdn/content#37516