Not default permissions, it turns out, but you have a global choice between letting sites ask for permission or blocking the requests entirely.
Safari lets you differentiate. I can set all sites to deny by default, configure Home Depot to always ask for permission (resets every 24 hours), and configure still others to always allow.