Response policy model. No browser request was sent.

Origin https://notes.club.invalid is listed.
Origin https://other.club.invalid is not listed.
The card's allow-origin value for a listed origin is that origin, not a star.
This policy does not permit credentialed cross-origin response access for an unlisted origin. Cookie sending follows separate browser rules.

A shell client does not consult this browser policy.
The server must independently authorize an action regardless of which client sends it.