Exercise 3: Why Push Notifications Need an Entitlement in the Provisioning Profile — Possible Solution
============================================================================================================

Architecture & Data Chapter 8 established that using a real, sensitive
device capability - the camera, location, or, in this case, push
notifications - requires the app to genuinely declare its intent, so
the system can enforce real permission boundaries rather than letting
any app silently do whatever it wants.

This chapter explained that a provisioning profile carries a specific
section for exactly this purpose: entitlements, which list the real
capabilities the signed app is actually permitted to use. Push
notifications are one such capability. Without the real Push
Notifications entitlement present in the app's own provisioning
profile, the app is never authorized to establish the real connection
to Apple's push notification service (APNs) that Architecture & Data
Chapter 8 relies on to deliver notifications at all - regardless of
what code the app itself contains.

This is a genuinely different, earlier checkpoint than the runtime
permission prompt a user sees and taps "Allow" or "Don't Allow" on.
The entitlement is checked before the app is even allowed to attempt
using the capability at the system level; the runtime prompt is a
separate, later check asking the actual person using the device
whether they personally consent. Both have to be satisfied - a
correctly entitled app can still be denied by the user, and a
correctly user-approved app with no matching entitlement still cannot
use the capability at all.

ANSWER: Push notifications require a real entitlement in the
provisioning profile because entitlements are the system-level
authorization for which capabilities a signed app is permitted to use
at all - a genuinely separate, earlier checkpoint from the runtime
permission prompt Architecture & Data Chapter 8 covered, which is the
user's own personal consent. Both the entitlement and the user's
consent have to be present for push notifications to actually work.

WHY THIS WORKS AS AN ANSWER
------------------------------
This correctly distinguishes the entitlement (a signing-time,
system-level authorization) from the runtime permission prompt (a
user-consent check), connecting this chapter's own provisioning-profile
material directly to Architecture & Data Chapter 8's own capability
coverage rather than treating the two as the same thing.