I lack the understanding what the effect of entitlements is during runtime. It seems like they are checked when certain APIs are called. For instance, if I have some code that r