Sorry, I'm not familiar with basic details: signature verification happens each time the program is started? Or only when it's installed? If it fails the sign

Sorry, I'm not familiar with basic details: signature verification happens each time the program is started? Or only when it's installed? If it fails the signature check, what is the default policy? Not to install/execute the binary? Or just log/warn?