The Consent Check calls the Policy Engine before any FHIR read returns PHI — including portal and partner traffic.
Consent withdrawals in the patient portal reload policy here on the next request; no gateway restart required.