diff --git a/csp-specification.dev.html b/csp-specification.dev.html
--- a/csp-specification.dev.html
+++ b/csp-specification.dev.html
@@ -291,16 +291,23 @@
               inject CSP policies into vulnerable documents.</li>
 
               <li>Ignore the <code>report-uri</code> directive in CSP policies
               obtained from <code>meta</code> elements. This requirement
               mitigates one attack that might result from an injected policy.
               It also provides a carrot for supplying the policy in an HTTP
               header, which is better for security.</li>
 
+              <li>To provide effective protection the user agent must know
+              about the <code>sandbox</code> and <code>frame-options</code>
+              directives before starting to render a document in a frame,
+              When either of these directives are encountered in a <code>
+              meta</code> element the user agent MUST ignore them and SHOULD
+              report a warning to the developer console.</li>
+
               <li>Add some guidance that sites should put the <code>meta</code>
               element as early as possible in their document to reduce the risk
               of an attacker injecting another policy in front.</li>
 
               <li>Ignore policies from <code>meta</code> elements that get
               inserted after the document's readyState reaches "interactive".
               This requirement further mitigates the risk of the
               <code>meta</code> element being injected.  (Is this requirement
@@ -1461,16 +1468,20 @@ token             = &lt;token from RFC 2
 
         <p>When enforcing the <code>sandbox</code> directive, the user agent
         MUST <a href="http://www.whatwg.org/specs/web-apps/current-work/#parse-a-sandboxing-directive">parse
         the sandboxing directive</a> using the <code>directive-value</code>
         as the <em>input</em> and protected resource's
         <a href="http://www.whatwg.org/specs/web-apps/current-work/#forced-sandboxing-flag-set">forced sandboxing flag set</a>
         as the output. [[!HTML5]]</p>
 
+        <p>The <code>sandbox</code> directive MUST be ignored when found in a
+        policy specified in a <code>meta</code> element. The user agent SHOULD
+        report a warning to the developer console.</p>
+
         <section class="informative">
           <h5>Usage</h5>
 
           <p>HTML5 defines a
           <a href="http://www.whatwg.org/specs/web-apps/current-work/multipage/the-iframe-element.html#attr-iframe-sandbox"><code>sandbox</code> attribute</a>
           for <code>iframe</code> elements, intended to allow web authors to
           reduce the risk of including potentially untrusted content by imposing
           restrictions on that content's abilities. When the attribute is set,