Demo build. Authorized-only (default-deny) surfaces ONLY rav-authorized sites — everything else is excluded by construction (so nothing unauthorized can slip through); the authorized list is small today, so results are sparse — that's the curated-list state, not a bug. Standard (block-list) shows the open web minus known-bad. Stricter levels filter more.