> Oh, another big reason, and why I think I'm no longer even debating this > question, we can reload the conditions without a restart via > relying-party.xml but not otherwise. Okay, sounds good. Just a comment that it did seem weird to define activation conditions per relying party in profile-intercept.xml (was post-authn.xml).