We're talking about the Speech API here, which isn't something an app like Hangouts would use. WebRTC, which is more suitable, does not have that restriction codified into its spec.

I agree with you, though the speech to text API is different than just microphone access. Something like video conferencing may not fall under the same rules.

One interesting thing is that web specs don't usually go into that much detail about UI, or at least that used to be the case. It was generally considered outside of the spec's purview, and it boxes in future browser interfaces that could be something very different than tabs and windows.

If you needed something, I would think something like there must be a visible notice to the user that their sound is being recorded, and if that notice becomes obscured, cease recording. But I'm not entirely sure it should be enforced on the spec level; instead it could have a non-normative security section and leave it up to the browsers to implement it well.

Indeed. Perhaps a reasonable compromise would be to have the permission apply to only the tab for which the user allowed it, and only as long as the tab remains pointed to that same domain. No inheriting permissions across child windows and no retaining the permission for that domain when future tabs are opened. Seems like it would reasonably fit the expectations of the user and I can't think it would put up unreasonable road blocks for developers.

Maybe there should be a secondary option to allow a site to use the mic in the background.