NewAuthority reads the store on every call through an immutable view, so a UI grant, revoke or deny applies to the next host call without a restart. The file and flag deny rules do not depend on the store. Assisted-by: Claude:claude-sonnet-5-5 go