Following up on the pieces we had last week that mentioned NGEN and security ... Reid has just posted a good piece about how NGEN deals with the fact that the grant set of an assembly can change from the time the assembly is NGENed to the time that it's run.  Basically, NGEN takes a snapshot of the assembly's grant set and saves that to the generated image.  Then, when the loader needs to get an assembly, it checks that saved set against the grant set that current policy would give the assembly.  If they are the same, then the NGENed version can be used.  Otherwise we have to fall back on the JIT to create a new native image.