Apparently I was only partly right. Each app is its own user, and certain permissions such as sockets and files are enforced using groups.

However, when the functionality that is being protected is implemented in a system service (which runs in a different process), it's the responsibility of the callee to check the permissions of the caller using Android's own 'permissions validation mechanism'.

http://www.cs.berkeley.edu/~afelt/android_permissions.pdf (Section 2.1)