Access is checked on the server for protected routes. If Discord authorization scopes change, users must re-consent by signing in again.