If they are authenticated to their ledger account then simple possession of the token in the account is sufficient verification. The use case I considered was

If they are authenticated to their ledger account then simple possession of the token in the account is sufficient verification. The use case I considered was a client for trading on XRPL. For an application like this they are going to be signing transactions to interact with the ledger. If they are able to sign and own a license token in their ledger account then they are the valid user.