Almost all actions in Declarative Web Request require all_urls host permissions

chrome/common/extensions/docs/templates/intros/declarativeWebRequest.html

 <h2 id="notes">Notes</h2>
 
 <p>
 Use the <code>chrome.declarativeWebRequest</code> module to intercept, block, or
 modify requests in-flight. It is significantly faster than the <a
   href="webRequest.html"><code>chrome.webRequest</code> API</a> because you can
 register rules that are evaluated in the browser rather than the
 JavaScript engine which reduces roundtrip latencies and allows very high
 efficiency.
 </p>
 
 <h2 id="manifest">Manifest</h2>
 
 <p>
 You must declare the "declarativeWebRequest" permission in the
 <a href="manifest.html">extension manifest</a> to use this API,
-along with <a href="declare_permissions.html">host permissions</a> for any
-hosts whose network requests you want to access.
+along with <a href="declare_permissions.html">host permissions</a>.
 </p>
 
 <pre>{
   "name": "My extension",
   ...
 <b>  "permissions": [
     "declarativeWebRequest",
     "*://*.google.com"
   ]</b>,
   ...
 }</pre>
 
 <p>
-Note that certain types of non-sensitive requests do not require host
+Note that certain types of non-sensitive actions do not require host
 permissions:
 <ul>
   <li><code>CancelRequest</code>
   <li><code>IgnoreRules</code>
   <li><code>RedirectToEmptyDocument</code>
   <li><code>RedirectToTransparentImage</code>
-  <li><code>RedirectByRegEx</code> when the redirect destination has
-    the same domain as the original request
-  <li><code>RedirectRequest</code> when the redirect destination has
-    the same domain as the original request
 </ul>
+</p>
+<p>
+The <code>SendMessageToExtension</code> action requires host permissions
+for any hosts whose network requests you want to trigger a message.
+</p>
+<p>
+All other actions require host permissions to all URLs.
+</p>
+<p>
+As an example, if <code>"*://*.google.com"</code> is the only host permission an
+extension has, than such an extension may set up a rule to
+<ul>
+  <li> cancel a request to "http://www.google.com" or "http://anything.else.com"
+  <li> send a message when navigating to "http://www.google.com" but not to
+"http://something.else.com"
+</ul>
+The extension cannot set up a rule to redirect "http://www.google.com" to
+"http://mail.google.com".
+</p>
 
 <h2 id="rules">Rules</h2>
 
 <p>
 The Declarative Web Request API follows the concepts of the <a
   href="events.html#declarative">Declarative API</a>. You can register rules to
 the <code>chrome.declarativeWebRequest.onRequest</code> event object.
 </p>
 
 <p>
@@ skipping 183 matching lines @@
 chrome.declarativeWebRequest.onRequest.addRules([rule1, rule2]);
 </pre>
 
 <p>
 It is important to recognize that the <code>IgnoreRules</code> action is not
 persisted across <a href="#evaluation">request stages</a>. All conditions of
 all rules are evaluated at each stage of a web request. If an
 <code>IgnoreRules</code> action is executed, it applies only to other actions
 that are executed for the same web request in the same stage.
 </p>