According to the documentation, your ShieldAction extension can return the .defer action to make iOS ask your ShieldConfiguration extension for a new shield that properly demonstrate this new state.
But I don't understand how you're supposed to detect this event in the ShieldConfiguration extension. The API that is called to fetch a configuration is always the same, it contains no context for why it is being called. You also can't store/share any information of your own because you get a new instance every time and the extensions are sandboxed.
How are you supposed to determine that a configuration is being requested as a result of the .defer action being triggered in order to return a completely different shield? The WWDC session for this feature shows that this is clearly possible, but it doesn't show the code that achieves it.
For context, I'm using Xcode 14.0.
You can share data between your app and its various extensions by configuring App Groups. Even though Shield Configuration extensions are heavily sandboxed, you should still be able to read data from your app group's container.