Huh. I wasn't aware I needed to (so thanks).

That would explain the behavior I'm seeing... but it's awfully confusing in the context of Parental Controls. So far as I understand, only one app can be authorized to set and remove shields on any given device, so I expected the ManagedSettingsStore to return something more like a system-wide singleton than something that is tied to the app. For instance, you authorize the app and not the extension because it requires user input, but I still expect the extension to be allowed to change shields. I'll try either calling back into the main app (somehow) from the extension or moving all the blocking into the extension itself and I'll report back.