Security server responses always based on class?

[dE <de.techno@xxxxxxxxx>]

Does the object manager always queries the security server based on 
classes? And does the security server always respond with an access vector?

OR

Can the object manager query the security server on specific permissions 
(which make up a class) without querying for a response for the whole 
security class?