most applications have that built into the application itself, and then it's using the same client that's being used to check permissions