The usual way - entitlements are held in a kernel data structure, and the kernel and associated system services won't allow access to APIs when the entitlement isn't there.

Try it on iOS, if you don't have the right entitlements system API calls will fail.