From that point on, it is the encrypted token that is used to prove the user's identity. In AFS, it is possible to authenticate into multiple AFS cells. AFS uses Kerberos to do complex mutual authentication which means that both the service requester and the service provider have to prove their identities before a service is granted. Transarc's implementation of Kerberos is slightly different from MIT Kerberos V4 but AFS can work with either version. Essentially, from a user's point of view, there is little difference between AFS and local unix filestore.
Many systems have the klog function built into the system login program.
So a user would not even have to know they gain a token on logging in. Unix mode bits for group and other are ignored. The mode bits for the file owner don't work the way they used to. Just use mode bits to make a file executable. Symbolic links work in AFS because they reference a pathname and not an i-node directly.