The current requestSession() algorithm specifies that the permission request should be done after creating the XRSession.

However I think the permission request algorithm does not have any dependency with the session. We do indeed need access to the XRSession's device, but that was obtained a bit earlier so we don't need the session for that. It's also mentioned that the XRPermissionDescriptor should be

initialized with session, requiredFeatures, and optionalFeatures

but it turns out that it just requires the XRSessionMode not the session itself.

My proposal would be to move the permission request step up and put it just before creating the new XRSession. I believe this fits very well with what's mentioned in the feature dependencies section

This will block the creation of the XRSession if any of the required features are unavailable due to device limitations or in the absence of a clear signal of user intent to expose sensitive information related to the feature.

WDYT?