No other plugin do you have to set daemon arguments for it. This requires restarting a daemon with different args as each new plugin is added. This is not how any other plugin works. They are all discovered.

I propose making AuthZ work the same. There should have never been a --authorization-plugins flag on the daemon, that setting should be configurable through the docker API after the plugin has started. If there are no AuthZ plugins already loaded the endoint would be free to hit, otherwise it would obviously defer to AuthN/AuthZ plugin that was loaded with regard to ability to change that setting.